Random Token / API Key Generator

The token is lowercase hexadecimal: digits 0 to 9 and letters a to f. The slider sets its length in hex characters, from 8 to 128 in steps of 2, and starts at 32. Every two characters represent one random byte, read straight from crypto.getRandomValues, so each character carries exactly 4 bits and there is no rounding or skew.

A token is created when the page loads. Moving the slider doesn't change it, so press Generate token after picking a length.

The tool outputs bare hex, like c274ac01919379ab807d1dc253907264. Many services add a short prefix that names the key type and environment, which makes leaked keys easy to spot in logs and code reviews. Add it yourself, for example myapp_test_ or myapp_live_ in front of the token. The prefix adds no secrecy, so keep the random part at full length.

When a library asks for a key as bytes rather than text, a 64-character token decodes from hex into exactly 32 bytes. Check whether the library expects the hex string itself or the decoded bytes. Mix the two up and two systems will compute different signatures from what looks like the same secret.

• Show it once. If you issue keys to users, display the full key a single time and keep only a hash of it on the server, plus the last four characters for identification.
• Keep it out of source code. Put it in an environment variable or a secrets manager. Hex contains no characters that need quoting, so it pastes cleanly into .env files and CI settings.
• Compare it safely. When checking a presented token, use your language's constant-time comparison function rather than ==.
• Plan for rotation. Generate the replacement before revoking the old token, so services can switch over without downtime.