Random string and API key generator
Made on your device. Never sent or stored.
Secure random strings for API keys, tokens, secrets and test data, in the format your code expects.
Choosing a format
| Format | Characters | Bits per character | Length for 128 bits | Good for |
|---|---|---|---|---|
| Hexadecimal | 0-9 a-f | 4.0 | 32 | Keys stored as hex, checksums, IDs in logs |
| Letters and digits | A-Z a-z 0-9 | 5.95 | 22 | API keys, passwords in config files |
| Base58 | No 0, O, I or l | 5.86 | 22 | Codes people read or type |
| URL-safe Base64 | A-Z a-z 0-9 - _ | 6.0 | 22 | Tokens in URLs and cookies |
128 bits is the usual target for a secret that must never be guessed. For a signing key, such as an HMAC or JWT secret, use at least 256 bits: 64 hex characters or 43 letters and digits.
Generating secrets in code
This page is handy for a one-off secret. In an application, generate secrets with your platform's secure generator rather than a general random function:
- Node.js:
crypto.randomBytes(32).toString('hex') - Python:
secrets.token_urlsafe(32) - Command line:
openssl rand -hex 32 - Browser:
crypto.getRandomValues(new Uint8Array(32))
Avoid Math.random() in JavaScript and random in Python for anything secret. They are fast but predictable once enough output has been seen.
Questions
Is this random enough for production secrets?
The randomness is the same Web Crypto source browsers use for TLS keys, with unbiased selection. For secrets that will live in production, many teams still prefer generating them on the server or in a secrets manager so they never pass through a clipboard.
Why Base58?
It drops the characters people confuse, zero and capital O, capital I and lowercase l, so a code can be read aloud or typed from a screen without mistakes.
How long should an API key be?
At least 128 bits of randomness: 32 hex characters or 22 letters and digits. Many services use 32 to 40 characters plus a short prefix that identifies the key type.
Sources
- Crypto: getRandomValues() method, MDN Web Docs. Checked 18 October 2026.