Updated · Built and checked by the PlinzoTools team, formulas tested against published sources
Generate a random API-key-style token with a configurable prefix.
Generating a key...
This tool generates a random token in the shape of a typical API key -- a readable prefix (like sk_live_, mirroring conventions used by services like Stripe) followed by a cryptographically random alphanumeric body. It's a format generator for testing/prototyping, not a real credential-issuing system.
Set a prefix and body length. Click Generate for a new random key.
The body is drawn from a mixed-case alphanumeric character set using the Web Crypto API's cryptographically strong random source, then appended to your chosen prefix -- the same general shape real API key systems use, though the actual key-issuing and validation logic lives entirely in a real service's backend, not in this standalone generator.
For a generic random string without the prefix convention, see the Random String Generator.
The tool opens with the prefix set to sk_live_ and a body length of 32, and it produces a key immediately. It regenerates automatically whenever you change the prefix or the length, so you do not have to press the button after every edit. The Generate New Key button simply draws a fresh random body with the current settings. Copy places the full key on your clipboard, and Download saves it as a plain text file. The body length is treated as at least 1 character; the number field suggests a maximum of 128, so stay within that range for predictable results.
Leaving the prefix empty is allowed. In that case the output is only the random body with nothing in front of it, which is handy if you want a bare token rather than a prefixed one.
Suppose you are writing documentation for an imaginary payments API and want an example key that looks realistic. You keep the prefix sk_test_ and set the body length to 24. The result has the form sk_test_ followed by 24 mixed-case letters and digits, for a total of 32 characters. Because the body draws from 62 possible characters (26 uppercase, 26 lowercase, 10 digits), each character carries a little under 6 bits of randomness, so a 24-character body has roughly 143 bits of randomness in principle. That is far more than a mockup needs, but it shows why longer bodies make guessing impractical.
Key = prefix + body, where body is a chosen number of characters, each picked from A-Z, a-z and 0-9
This page generates the key in your browser and does not register it anywhere, so no server will ever accept it. Treat every value as a placeholder. If you need a real credential, create it inside the service that will validate it, store it in a secrets manager or environment variable, and never commit it to a repository. Also remember that anything you paste into a shared document or chat can be seen by others, so do not reuse a generated value as a real password or secret just because it looks strong.
The character set is letters and digits only, with no dashes, underscores or symbols in the body, so the output is safe to place in URLs, headers and most configuration formats without escaping. The only special characters come from the prefix you type, such as underscores.
No -- it's a randomly generated string in a common API-key shape, not a credential issued or recognized by any real service; use it for mockups, documentation examples, or local test placeholders only.
Prefixes let a service (and its users) instantly identify a key's type and environment (e.g. "sk" for secret key, "live" vs. "test") just by glancing at it, and let automated secret-scanning tools reliably detect leaked keys in code or logs.
The body uses the Web Crypto API's cryptographically strong random source, the same quality of randomness used by the Password Generator.
Yes. The tool regenerates automatically whenever the prefix or body length changes, and the Generate New Key button gives you another random body with the same settings.
Yes. With an empty prefix the output is just the random body, without any leading label.
Only uppercase letters, lowercase letters and digits, which makes the result safe to paste into URLs, headers and config files without escaping.
Not for a service that issues its own credentials, because that service will not recognize it. For your own internal tokens, a random value of sufficient length is a reasonable starting point, but generate and store secrets through your production tooling rather than a web page.
Reference: MDN Web Docs