Softonic

Random API Key Generator

Step 1 / 2
Format

Generate keys with PHP’s cryptographically secure server-side random functions. Choose hex, URL-safe base64, alphanumeric or UUIDv4, request 8–128 random characters, and optionally add a prefix such as sk_live_. The prefix and settings are sent to the server; generated values are returned to this page.

How to generate an API key

  1. 1

    Choose the output length

    Set 8–128 random characters. UUIDv4 has a fixed 36-character representation, so the length control is disabled.

  2. 2

    Pick a format

    Choose lowercase hex, URL-safe base64, alphanumeric characters or UUIDv4.

  3. 3

    Add a prefix if you want

    A prefix like sk_test_ helps you spot leaked keys in logs and GitHub scanning.

  4. 4

    Generate and copy

    Click regenerate until you get a key shape you like; copy and store it in your secret manager.

Why use a CSPRNG

PHP generates the random bytes on the server with random_bytes() and selects alphanumeric characters with random_int(). Both are designed for cryptographically secure randomness. Generation therefore requires a request to this site; do not treat it as a browser-only tool.

Encoding cheatsheet

Format Output characters Length control
Hex 0-9 a-f 8–128 characters
Alphanumeric 0-9 A-Z a-z 8–128 characters
Base64url A-Z a-z 0-9 - _ 8–128 characters
UUIDv4 Hex digits and hyphens Fixed at 36 characters

Sizing guidance

  • A 32-character hex value carries 128 random bits.
  • A 22-character alphanumeric or base64url value carries about 131–132 random bits.
  • UUIDv4 has 122 random bits because its version and variant fields are fixed. It is useful as an identifier, but an opaque API token is often easier to rotate and prefix.

Operational tips

  • Store keys hashed in the database (e.g. SHA-256), show them once on creation, and save the hash only.
  • Prefix keys by environment: sk_live_ vs sk_test_.
  • Rotate by issuing a new key before revoking the old one to avoid downtime.

Frequently Asked Questions

Each hex character carries 4 bits, so 32 hex characters contain 128 random bits. UUIDv4 is also 128 bits long, but only 122 bits are random because the version and variant fields are fixed.

No. Hash it with SHA-256 or argon2 before saving. When an API caller presents the key, hash what they sent and compare. If your database leaks, the attacker only gets hashes.

Yes. The prefix is limited to 64 characters and is added before the random part. Keep it short and use it only to identify the key type or environment.

The site generates it on the server with PHP random_bytes() and random_int(), which use operating-system sources suitable for cryptographic secrets. Your settings and optional prefix are sent to the server.

Related Tools

A1Z26 Cipher Encoder

Encode text using the A1Z26 cipher (A=1, B=2, ... Z=26) or decode a number sequence back to letters, with customizable separator.

Cipher Identifier

Paste ciphertext and the identifier suggests likely encoding/cipher schemes: Base64, hex, binary, Morse, Caesar or substitution, JWT and common hashes.

Atbash Cipher Encoder

Encode or decode text with the Atbash cipher, a Hebrew substitution that maps A-Z to Z-A. Same operation encrypts and decrypts.

Encryption Identifier

Paste a ciphertext or hash and the identifier suggests likely algorithms or encodings: MD5, SHA, bcrypt, AES, RSA, Base64 and more.

Caesar Cipher Encoder

Encrypt and decrypt text using the Caesar cipher. Any shift 1-25, supports ROT13 as a special case, preserves punctuation and case.

CSR Generator

Generate a PEM-encoded Certificate Signing Request and matching RSA private key. Specify the Common Name, organisation fields and key size (2048, 3072 or 4096 bits).

Tool available in other languages