Random Token Generator — API Keys & Secrets

← Safe HarborThe Creative Island · Island 14

API keys, hex secrets, URL-safe tokens — generated with cryptographic randomness, on your device.

Length (bytes)

Format Hex (0-9a-f) URL-safe (A-Za-z0-9-_) Base64

Generate client-side only for local use or your own system. Real production API keys must come from the service that will verify them — never from a web page.

How to use this tool

1. Choose the byte length (32 bytes / 256 bits is the modern standard for secrets).
2. Pick a format: hex for classic API keys, URL-safe for paths and query strings, Base64 for compact tokens.
3. Generate, copy, and store it somewhere safe — there is no 'recover' button for random secrets.

Example

A 32-byte hex token looks like 9f86d081884c7d659a2feaa0c55ad015… — 256 bits of entropy, meaning every possible key is equally likely and guessing is hopeless at any scale.

The formula

crypto.getRandomValues → N random bytes → hex (2 chars/byte), URL-safe base64url, or 6-bit alphabet

What the result means

Tokens differ from passwords in one way: no human ever types them, so length and uniform randomness are the only design constraints — and both are free. 256 bits is the standard because it leaves brute-force dead for any future hardware we can imagine, and because hashing (which halves the search space) still leaves it uncrackable.

Frequently asked questions

Can I use these as real API keys?

For local projects, testing and your own systems, yes. For a production service, the issuing server must generate the key (it stores a hash to verify) — a page-generated string can't be verified by anyone but you.

What length should I pick?

32 bytes (256 bits) for anything. 16 bytes (128 bits) is acceptable for short-lived or low-value tokens.

Why URL-safe instead of standard Base64?

Standard Base64 contains + and /, which break URLs and filenames; the URL-safe alphabet swaps them for - and _ and drops padding.

Are generated tokens stored anywhere?

No — generation is local; refresh the page and it is gone forever.

More tools from Safe Harbor

Password GeneratorStrong random passwordsHash GeneratorSHA-256 & friendsRandom Number GeneratorFair random drawsPassword Strength CheckerJudge an existing password

Explore the island world

• Safe Harbor — the island where this tool lives.
• The Main Island — drive the boat, explore the whole world.
• The 90s Kids Island — where most of us started.

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer