API Key Generator

Seed data needs something that looks like an API key without being one. A hardcoded test123 in a fixture file reads as obviously fake the moment a screenshot goes into a slide deck, and a real key checked into a repo by accident is a much worse problem than either. API Key Generator sits between those two failure modes: random output shaped like a credential, generated fresh every time, never checked against or registered with anything.

Every character comes from crypto.getRandomValues, drawn with rejection sampling so no byte value gets folded onto the alphabet unevenly. Nothing about the output is derived from the prefix you type or the time on your clock, which is exactly what a placeholder value should not leak.

The Controls: Prefix, Encoding and Length

• Six prefix presets sit under the text field, from sk_live_ and ghp_ to None, but the field itself accepts anything up to 24 characters, including no prefix at all.
• The random part length slider runs from 8 to 128 characters and reports its own entropy live, so 40 characters of Base64URL reads 240.0 bits right under the slider before you generate anything.
• How many keys generates up to 20 at once, each one an independent draw rather than a single key repeated with a counter suffix.
• Every row in the results list carries its own small refresh icon. Clicking it redraws that one key in place, leaving the rest of the batch untouched — a full re-generate is not the only way to swap out a single bad-looking sample.

Format Notes: Hex, Base64URL and Alphanumeric

• Hex draws from a 16-character pool (0–9, a–f), so 40 characters carries 160.0 bits — the lowest density of the three, and the safest to paste somewhere that only expects lowercase and digits.
• Base64URL draws from the 64-character RFC 4648 URL-safe alphabet (letters, digits, - and _, no padding), the densest of the three at 240.0 bits for the same 40 characters.
• Alphanumeric draws from the 62 upper- and lowercase letters and digits with no symbols at all, landing at 238.2 bits — close to Base64URL's density without a character that could break a shell one-liner or a CSV column.

When Not to Use This for Real Credentials

A string that looks like a Stripe or GitHub key is not one, and this page never contacts Stripe, GitHub, or anything else to check.

• Nothing generated here authenticates against a real API. Using output as a placeholder in a UI mockup or a seeded test database is the intended use; using it as an actual secret is not, because it was never registered anywhere to begin with.
• A real secret belongs in an environment variable or a secret manager, rotated by the service that issued it — never typed into a browser tool, this one included, since anything typed into a page can in principle be logged by that page.
• The prefix field is cosmetic. Typing sk_live_ does not make the suffix cryptographically related to Stripe's key format beyond the shared prefix string.