How to Generate a Secure API Key or Secret
A good API key is long, random and unpredictable. Learn what makes a secret secure, how many bits you need, and how to generate one safely in your browser.
A secure API key is a long, random string generated from a cryptographic source, with enough length that it cannot be guessed. Aim for at least 128 bits of randomness — roughly a 22-character Base62 token or 32 hex characters.
What makes a key secure
- True randomness — generated from
crypto.getRandomValues, not a predictable seed - Enough length — 128 bits resists brute force; 256 bits is common for high-value secrets
- A safe alphabet — Base62 or hex avoids ambiguous symbols and URL issues
Handling secrets safely
- Never commit keys to a repository or hard-code them in client-side code
- Store them in environment variables or a secrets manager
- Rotate keys periodically and revoke any that leak
Generate one now
Create a random API key or token with the token generator — it runs entirely in your browser, so the secret never leaves your device. Need a memorable human password instead? See How to create strong passwords.