API Token Generator
Generate cryptographically secure tokens and API keys in Hex, Base64-URL, and alphanumeric formats for authentication and access. GDPR-compliant.
Your inputs are processed in your browser and are not transmitted to our servers. Note: third-party resources (e.g. advertising and analytics from Google/Cloudflare) and an optional PayPal donation link may transfer data when loading or when clicked. Browser extensions or plugins may be able to read content that is visible in the input fields.
The result will appear here …
How to use this tool (video)
This video is hosted on YouTube. When you play it, data may be sent to Google.
API Token Generator – Cryptographically Secure Tokens
API keys, secret keys, and access tokens are the backbone of modern authentication. Whether you need them for REST APIs, OAuth, JWT secrets, or session tokens, each key has to be cryptographically random and long enough to resist brute force attacks.
This tool generates keys in your browser using crypto.getRandomValues(). Pick from Hex, Base64-URL, alphanumeric, or numeric formats, set the length, and optionally add a prefix like sk- or pk_. Entropy is shown in bits so you know exactly how secure your token is.
Which token format for what
- Base64-URL (A-Z, a-z, 0-9, -_): the modern standard for API keys, URL-safe and compact
- Hex (0-9, a-f): classic for MongoDB IDs, session IDs, and hash representations
- Alphanumeric (A-Z, a-z, 0-9): readable, good for one-time codes or activation tokens
- Numeric (0-9): for SMS codes, 2FA codes, and TANs
How much entropy does a token need?
- 128 bits: minimum for API keys and access tokens in production
- 192 bits: recommended for long-lived secrets and master keys
- 256 bits: standard for JWT secrets and cryptographic applications
- Under 80 bits: only suitable for short-lived, single-use codes
The tool shows real-time entropy and warns you when it falls below 128 bits, so your API keys and secrets always meet current security standards.
Frequently asked questions
What is an API token?
An API token is a secret key that applications use to authenticate against an interface. It identifies the caller and grants access to protected functions, much like a password but for machines.
Which token format should I choose?
For API keys and tokens, Base64-URL is the modern standard because it is URL-safe and compact. Hex suits IDs and hash representations, alphanumeric for readable codes, and numeric for SMS or 2FA codes.
How many entropy bits does my token need?
For API keys and access tokens in production, 128 bits is considered the minimum. For long-lived secrets 192 bits are recommended, and 256 bits for JWT secrets and cryptographic applications. The generator warns you when the value drops below 128 bits.
What does the prefix do?
A prefix is an optional string at the start of the token, such as sk- or pk_. It helps distinguish different token types and is not part of the secret itself. You can set it freely in the generator.
How many tokens can I generate at once?
You set the desired quantity and the generator creates several independent tokens at once. This is handy when you need keys for multiple environments or services.
Are my tokens really secure?
Yes. The random values come from crypto.getRandomValues(), the same cryptographic source browsers use for secure connections. Everything stays local in your browser and is neither transmitted nor stored.