API Key Generator
Generate cryptographically random API key strings with an optional prefix and configurable length. Built for backend developers who need placeholder keys for tests, seeds for local development, or a quick secret for a webhook.
How to use
- Choose a prefix such as sk_live_ or vk_test_ (or leave it blank).
- Set the desired key length in characters.
- Pick the character set: hex, base62, or URL-safe base64.
- Click Generate and copy the result with one click.
An API key is a shared secret that identifies a client to a server. Good keys have two properties: enough entropy that they cannot be guessed, and a recognisable prefix so humans and secret scanners can tell what they are. Stripe popularised the sk_live_ / sk_test_ convention, and GitHub's ghp_ prefix lets its scanning partners revoke leaked tokens within minutes, a prefix is not decoration, it is an operational feature.
This generator uses a cryptographically secure random source (CSPRNG), not a seeded pseudo-random function, so every key is suitable for real use. A 32-character base62 key carries roughly 190 bits of entropy, far beyond brute-force range. If you plan to store keys in a database, store only a SHA-256 hash of the key and keep the prefix plus last four characters in plain text for display, the way payment providers do.
Common uses: seeding .env files for new services, generating per-tenant keys during a migration, creating webhook signing secrets, and producing fixtures for integration tests. One gotcha: avoid ambiguous characters (0/O, 1/l) if humans will ever read keys aloud, the hex charset sidesteps this entirely. Velona generates keys server-side and discards them immediately. Nothing is logged or stored for anonymous users.
Examples
Input: prefix=sk_test_, length=32, charset=base62
Output: sk_test_h8Kq2mNvXr4TzWp9aJcE5bLdY7fGnR3sInput: prefix=(none), length=40, charset=hex
Output: 3f9a1c7e5b2d8f04a6c3e19b7d5f2a8c4e6b0d13Input: prefix=whsec_, length=24, charset=base64url
Output: whsec_Zk3xQ9pL-mN7vR2tYw4BFrequently asked questions
Are the generated API keys secure enough for production?
Yes in terms of entropy, they come from a CSPRNG, the same class of randomness your language's secrets module uses. That said, for production systems prefer generating keys inside your own infrastructure so the secret never crosses the network, even over TLS.
Does Velona store the keys it generates?
No. Keys are generated per request and returned once. Anonymous usage stores nothing. Signed-in users only get a record that they ran the tool, never the generated value.
What length should an API key be?
32 characters of base62 (~190 bits) is comfortably more than the 128 bits generally considered unguessable. Longer keys add safety margin at no real cost. Shorter than 22 base62 characters starts to erode it.
Why do API keys have prefixes like sk_live_?
Prefixes make keys self-describing: developers can see the environment at a glance, and secret-scanning tools can detect leaked keys in public repos and trigger automatic revocation.
Related tools
Velona is India's INR-native AI API gateway with 300+ models, UPI top-up from ₹10, no foreign card needed. These tools are free forever.