Generate random keys, tokens and secrets for your own app or API. Choose the length and the character set, add a prefix such as sk_live_ if you like, and make as many as you need. Each one is built from your browser's secure random number generator and comes with its strength in bits. These are new random strings for your own system, not keys for any other service.
The strength of a random key comes from two things only: how many symbols each position can hold, and how many positions there are. A 32-character hex key can be one of 16 to the power of 32 values, about 3.4 x 10 to the 38. An attacker cannot try them all, which is the point. What matters is that the characters are truly random, not that they look random.
That is why the source of randomness matters more than the alphabet. General-purpose random functions can be predicted by someone who has seen enough of their output, whereas the operating system's secure generator is designed to resist that. When you write your own in JavaScript, use crypto.getRandomValues and avoid Math.random for anything secret.
A good key can still be lost through bad handling. Treat it like a password: send it over HTTPS only, keep it out of logs and error messages, and store a hash rather than the key itself. A fast hash such as SHA-256 is acceptable for long random keys, because unlike a short human password they cannot be guessed offline.
Plan for the day a key leaks. Give every key an identifier, a creation date and, if you can, an expiry. Offer a way to see when each key was last used, so a customer can spot one that should be revoked. A short prefix before the random part makes it easy to recognise which kind of key you are looking at.
Each character is chosen with the browser's cryptographically secure random number generator (crypto.getRandomValues). Values that would make some characters more likely than others are thrown away and redrawn, so every character in the set is equally likely. The page does not use Math.random, which is not suitable for secrets.
Strength in bits = length x log2(number of symbols in the set). Hex has 16 symbols, so 4 bits each: 32 characters give 128 bits. Base64url has 64 symbols, 6 bits each: 22 characters give 132 bits. Letters and digits have 62 symbols, about 5.95 bits each: 20 characters give about 119 bits.
No. A hash is a fixed-length fingerprint made from some input. These are random strings that are not derived from anything. If you need a hash of a file or password, use a hashing function in your own code.
No. Keys for another company's service are issued by that service, from your account on its site, and a random string made here will not be accepted. Use this tool for keys, tokens and secrets of your own app or API.
No. They are generated in your browser and not uploaded or saved. Close or refresh the page and they are gone, so copy what you need first.
Related: UUID generator, JSON generator, Hex converter.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.