API key generator

Generate a random string for your API

Use this tool for your own API, test fixtures or a prototype. A generated string becomes a working credential only when your server registers and validates it. The generator does not connect it to an account or grant access on its own.

If you need a key for an existing service, get it from that provider. Adding a familiar prefix here will not create a working Gemini, Steam or other service key.

Choose the settings, then copy your keys

1. Set Amount to a whole number from 1 to 100.
2. Choose a Length: 64, 128, 256, 512, 1024 or 2048 characters for the random part. These are character counts, not bit lengths. Check your application’s accepted length before choosing.
3. Enable at least one character set: A–Z, a–z, 0–9 or Symbols. The selected sets form the pool to draw from; each key is not guaranteed to contain every selected character type.
4. Add a Prefix if you need one. For example, demo_ plus 64 random characters produces a 69-character string. The fixed prefix adds no randomness. It is saved in a settings cookie, so do not paste an existing secret into this field.
5. Click Generate. Click an individual block to copy that key. Switch to List to copy the batch or download api-key.txt; choose a line break, comma or tab as the separator.

Switching between blocks and a list keeps the same keys. Clicking Generate again replaces them with a new batch.

Reading the Base64 and hash results

Each result includes transformations of the complete string, including its prefix. Base64 is reversible encoding, not encryption. This is standard Base64, which can contain +, / and =, rather than Base64URL.

MD5, SHA-256 and SHA-512 are hashes of that same string, not three independently generated secrets. Hashing does not add randomness. Keep MD5 for comparison or compatibility with an existing format, rather than choosing it for new security designs; RFC 6151 explains its limitations. Use the representation your application actually expects.

Where key management happens

The generator uses the browser’s Web Crypto API to select random values. This does not promise that a duplicate can never occur. Your API must check for collisions when issuing keys and enforce permissions, expiry, request limits and revocation on the server.

Generating strings here is free. A provider’s API access, quotas and billing are separate. For example, Google documents how to obtain Gemini keys, and Postman issues keys through your Postman account.

Keep working credentials in a secret manager, out of source code, public repositories and screenshots. Use separate keys for separate environments. Replace an exposed credential and revoke the old one in your API or provider account; GitHub’s credential guidance covers these practices. For an ordinary account login, use the password generator.