API Key & Random Token Generator
Generate API keys, tokens, salts and nonces from 16–64 random bytes as hex, Base64, Base64URL, Base62 or Crockford Base32, with a prefix, checksum and SHA-256.
API keys, session tokens, password-reset tokens, salts and nonces all need the same thing: enough unpredictable bits. This generator draws 16 to 64 bytes from the browser’s secure random source and formats them as hex, Base64, Base64URL, Base62 or Crockford Base32, with an optional recognisable prefix, dash grouping and a CRC-32 checksum, and shows the SHA-256 you should store instead of the key.
How to use this tool
- Choose the number of random bytes (32 is a good default).
- Pick an encoding: Base62 or Base64URL for URL-safe keys, hex for maximum compatibility.
- Add a prefix such as sk_live_ so leaked keys are easy to find and revoke.
- Copy the keys, and save only their hashes on your server.
Formula
Entropy = random bytes × 8. Lengths: hex 2n, Base64 4⌈n/3⌉, Base64URL ⌈4n/3⌉, Base62 ⌈8n / log₂ 62⌉, Crockford Base32 ⌈8n/5⌉ characters.
The optional checksum is CRC-32 of the prefix and body, written as 6 Base62 characters after an underscore — the idea GitHub uses so that tokens can be validated offline and found by secret scanners. It detects typos; it adds no security.
Example
32 random bytes give 256 bits. As hex that is 64 characters; in Base62 it is 43 characters, so with the prefix sk_live_ the key is 51 characters long, or 58 with the checksum.
Frequently asked questions
How long should an API key be?
128 bits (16 bytes) is already impossible to guess; 256 bits (32 bytes) is the common choice and leaves a wide margin. Length beyond that only makes keys harder to handle.
Why store a hash instead of the key?
If your database leaks, hashed keys cannot be used. Because the keys are random and long, a fast hash such as SHA-256 is enough — no slow password hash is needed.
Can I use this for salts and nonces?
Yes. Use 16 bytes or more for salts and the exact size your algorithm needs for nonces (12 bytes for AES-GCM), and never reuse a nonce with the same key.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/api-key-generator/
Cite or embed this tool
kakaoCalc. (2026, November 8). API Key & Random Token Generator. https://kakao.mobile/tools/api-key-generator/
“API Key & Random Token Generator.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/api-key-generator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms