# API Key & Token Generator

URL: https://phishdestroy.io/developer-tools/api-token-generator
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Generate random API keys, tokens and secrets of a chosen length and alphabet with crypto.getRandomValues, optionally starting with a prefix such as sk_ or pk_.

## Example input

Tokens with a prefix

```
test_
```

Gives five tokens made of test_ and 32 random letters and digits, about 190 bits each; the prefix is fixed text and adds no randomness.

## FAQ

### How much entropy does a token have?

Roughly the length times log2 of the alphabet size: 32 alphanumeric characters give about 190 bits and 32 hex characters 128 bits. Bytes are mapped to characters with a modulo, which makes some characters slightly more likely for alphabets other than hex and costs less than 0.02 bits per character.

### Why add a prefix like sk_ or pk_?

A fixed prefix tells people and secret scanners what the token is, so leaked keys are easier to spot and revoke; GitHub's ghp_ tokens work this way. Pick your own prefix, because copying another service's format can trigger false alerts in secret scanners.

### Are the tokens sent or stored anywhere?

No. They are generated in your browser and never uploaded or saved. Keep them in a secrets manager, not in client-side code.

## Related tools

- [Password Generator](https://phishdestroy.io/developer-tools/password-generator)
- [UUID v4 Generator](https://phishdestroy.io/developer-tools/uuid-generator)
- [API Key Format Tester](https://phishdestroy.io/developer-tools/api-key-format-tester)
- [HMAC Generator](https://phishdestroy.io/developer-tools/hmac-generator)
- [JWT Generator (HS256)](https://phishdestroy.io/developer-tools/jwt-generator)

All tools: https://phishdestroy.io/developer-tools