Tool
What the API Key Generator does
API Key Generator: generates API key from Key length and Prefix. Example: key length 40 and prefix sk_live_ gives API key sk_live_TMz7CN2qn2BJwgUJ1EKJ2fZgU37cvizXkHVgkJoc.
Enter Key length and Prefix and the API Key Generator reports API key. Fill in the fields, run it, and the output shows up underneath.
Most people who open the API Key Generator are developers generating credentials. Length buys far more protection than complexity rules ever did.
Because it is all local, the tool is as fast as your device and as private as your own notes.
The meaning of each field, the formula in use, and a worked example that starts from the default inputs are all further down.
What do the API Key Generator fields mean?
The API Key Generator uses 2 inputs. You do not have to fill everything in before seeing an answer; the starting values already produce one.
| Field | What to enter | Default |
|---|---|---|
| Key length | accepts 16 to 128 | 40 |
| Prefix | choose from sk_live_, pk_, api_ or None | sk_live_ |
How does the API Key Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
Checks happen up front, so errors surface next to the form instead of hiding in the output.
Worked example
These are the values the API Key Generator loads by default, and the result it produces from them. This is the worked example the page starts from, reproduced here so you can check the arithmetic.
| Key length | 40 |
|---|---|
| Prefix | sk_live_ |
| API key | sk_live_TMz7CN2qn2BJwgUJ1EKJ2fZgU37cvizXkHVgkJoc |
|---|
A shaped random string, not a real service credential
This produces a random, high-entropy string styled like a real API key: base58 characters (which exclude 0/O/I/l to avoid transcription errors) with an optional recognisable prefix such as sk_live_. It is not a credential issued by any actual service; it is a placeholder generator.
Worth knowing
- Base58 is the same alphabet used by Bitcoin addresses and several real API-key formats, specifically because removing visually similar characters (0/O, I/l/1) reduces transcription mistakes when a human reads or types the key.
- A real API key of this shape should be treated exactly like a password: kept in a secrets manager or environment variable, never in source code, and never committed to a repository, public or private.
- GitHub, GitLab and most major hosts run automatic secret-scanning that flags key-shaped strings pushed to a repository: a generated key that happens to match a real provider’s prefix pattern (sk_live_, for instance) can trigger a false-positive alert. That is the scanning working as intended, not a bug to route around.
- Unlike a password, most real API keys cannot be changed to a new memorised value. They can only be revoked and reissued. Recording what each generated key is for at the moment you create it makes eventual rotation far less painful.
How to use it
- Enter Key length (16 to 128).
- Pick a value for Prefix: the options are sk_live_, pk_, api_ or None.
- Press Generate key.
- You get API key back.
- Copy Link puts the current inputs in the URL, so bookmarking it brings the same numbers back.
What this tool does not do
- Anything generated here is only as safe as where you store it afterwards.
- Anything generated here is only as safe as wherever you store it afterwards.
- Nothing is saved between visits, so keep your own record of anything you need again.
- It validates ranges, not intent. A value can be accepted and still be the wrong one to use.
Frequently asked questions
2 things: Key length and Prefix. Every box already holds a working value, meaning you can explore the calculation before committing to real figures.
Key length accepts 16 to 128. Out-of-range entries are refused up front, which is safer than silently clamping them.
With the values loaded when the page opens, API key comes out as sk_live_TMz7CN2qn2BJwgUJ1EKJ2fZgU37cvizXkHVgkJoc. The figure is derived from the inputs above, so it updates whenever they do.
Nothing is logged. The tool is client-side code; your data stays where you entered it.
No. There is no account, no usage cap and no trial period. The site is funded by advertising rather than by charging for the tools.
It implements the published definition directly, without shortcuts or approximations.