What is the Random Token & API Key Generator?
This generator produces random strings for API keys, session secrets, invite codes, webhook signing keys and test fixtures. Set any length from 1 to 512 characters and create up to 200 tokens at once. Pick the alphabet that fits your system: hexadecimal (0–9, a–f), letters and numbers, letters only, numbers only, Base64, URL-safe Base64, binary (0/1) or a custom character set you type in yourself.
An optional prefix is added to the start of every token, so you can mimic real-world key formats such as sk_test_ or live_ and make keys easy to recognize in logs. The letter case setting lets you keep mixed case or force everything to lowercase or UPPERCASE.
Every character is picked with the Web Crypto API in your own browser, so the output comes from a cryptographically secure source and is never sent to or stored on a server. The strength of a token depends on its length and alphabet: each character adds log2 of the alphabet size in bits, so 32 letters-and-numbers characters carry roughly 190 bits of randomness.
How to use the Random Token & API Key Generator
- Set the Length of each token and How many? you need (up to 200).
- Choose the Characters set — or select Custom characters and type your own alphabet.
- Optionally add a Prefix and pick the letter case.
- Press Generate, then copy a single token or export the list as CSV, JSON or TXT.
Popular uses
- Backend developers — create API keys, client secrets and signing keys for new services.
- QA testers — fill token fields with valid-looking values of any length.
- DevOps engineers — generate secrets for environment variables and config files.
- Product teams — produce invite, referral or voucher codes from a custom alphabet.
- Educators — demonstrate how alphabet size and length affect entropy.
Why use RandNow?
- Instant & unlimited — no sign-up, no daily caps.
- Private by design — results are generated in your browser, not on our servers.
- Export-ready — copy, CSV, JSON and TXT downloads built in.
- Cryptographically random — powered by the Web Crypto API.
How long should an API key be?
For secrets that protect real systems, aim for at least 128 bits of randomness. That is 32 hex characters, about 22 letters-and-numbers characters or 22 URL-safe Base64 characters. Longer is cheap and harmless, so many teams use 32–64 characters. Choose URL-safe Base64 or hex when the token will travel in URLs or headers, since standard Base64 includes + and / which may need escaping.
Handling tokens safely
Store secrets in a secrets manager or environment variables, never in source control, and rotate them if they leak. Prefixes help scanners spot exposed keys. Press Generate again for a fresh set — it’s free and unlimited.
Frequently asked questions
Are these tokens secure enough for production?
Yes. Characters are chosen with the Web Crypto API, a cryptographically secure random source, and nothing leaves your browser. Use a sufficient length — 32 characters or more is a sensible default.
Can I use my own characters?
Yes. Choose “Custom characters” in the Characters menu and type the exact set of symbols you want each token to be built from.
What is the maximum token length?
Each token can be up to 512 characters long, and you can create up to 200 tokens in one batch.
What is the difference between Base64 and Base64 URL-safe?
Standard Base64 uses + and /, which have special meaning in URLs. The URL-safe variant replaces them with - and _, so the token can be placed in links and query strings without encoding.