Generate secure API keys and access tokens with configurable formats, prefixes, and cryptographic randomness.
This tool builds a random token by combining an optional prefix (like sk_live_ or a custom label) with a body of random characters drawn from a charset you pick - hex, base64url, or alphanumeric - at a length you set. The randomness comes from the browser's cryptographic RNG rather than a simple pseudo-random function. The output is a string that merely looks like a real API key: it has no connection to any actual service, so pasting it into a provider's dashboard as if it were an issued credential will not work.
Each character of the token body is drawn using the browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure pseudo-random number generator seeded from OS entropy. This differs from Math.random(), which is not designed to resist prediction and should never be used for anything security-sensitive.
The final string is prefix + separator + random body, where the body's character set (hex, base64url-safe, or alphanumeric) and length are set independently of the prefix. Length settings apply to the random portion only, so two keys with the same length setting but different prefixes will differ in total string length.
The randomness itself is cryptographically strong if drawn via the Web Crypto API, but usable security also depends on the length and charset you chose. A short key (say 8 hex characters) is guessable even with perfect randomness. Use enough characters - 32+ hex or base64url characters is a reasonable floor for a real secret.
No, not with a third-party service - that provider has to recognize the value before it will accept requests using it, and this tool has no way to register anything with them. A self-hosted service or internal script you control is different: if that system is configured to accept a specific value as a valid credential (some store only a hash of the secret, others store it directly), a string generated here can work as a real secret once you register it there.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.