Contact

Tools  /  Security  /  API Key Format Generator

SECURITY

API Key Format Generator

Format-realistic fake API keys for 13 real services (Stripe, GitHub, AWS, Google, Slack, SendGrid, OpenAI, npm, Twilio, UUID) or a fully custom format -- for test fixtures and demos, never real/active credentials.

More Security tools

UUID Validator OAuth URL Builder Basic Auth Generator Bearer Token Builder Password Strength Checker Passphrase Generator

What this tool does

Generates format-realistic fake API keys matching the publicly documented key shape of 13 real services -- useful for seeding test fixtures, redacting examples in documentation, or populating a demo UI without using (or accidentally leaking) a real credential. A generated key is never valid or active against the real service -- it matches the public format only, not the private issuance process that actually activates a real key.

Formats included

Stripe (sk_live_/pk_live_), GitHub classic (ghp_) and fine-grained (github_pat_) personal access tokens, an AWS Access Key ID (AKIA...) and Secret Access Key, a Google API key (AIza...), a Slack bot token (xoxb-...), a SendGrid key (SG....), an OpenAI-style key (sk-...), an npm token (npm_...), a Twilio Account SID (AC...), a standard UUIDv4-based key, and a fully custom prefix/length/character-set format.

Unbiased randomness

Every character is drawn via crypto.getRandomValues() with rejection sampling against each format's actual alphabet size -- not a plain modulo, which is measurably biased toward lower alphabet indices whenever the alphabet size doesn't evenly divide 256.

Why these aren't real keys

A real API key is only valid because the issuing service's servers recognize it -- it's not derived from the format alone. These generated values match the public shape (prefix, length, character set) each provider documents, but have never been issued by anything, so they will always fail authentication against the real service. That's the point: safe-to-paste-anywhere placeholder values that still look like the real thing for a screenshot, a test fixture, or a code example.

Bulk generation and entropy

Generate several keys at once for seeding multiple test accounts or fixtures, with the real entropy (bits) of the random portion shown for whichever format is selected.

Privacy

Every key is generated entirely in your browser. Nothing is uploaded, and nothing is kept once you leave the page.

FAQ

Frequently asked questions

Are these real, usable API keys?
No -- they match the public format (prefix, length, character set) each provider documents, but a real key is only valid because the issuing service's own servers recognize it as something they actually issued. A generated value here has never been issued by anything and will always fail authentication against the real service.
What is this actually useful for?
Seeding test fixtures, redacting a real key in documentation or a screenshot with something that still looks plausible, populating a demo UI, or writing tests that check key-format validation logic -- all without using or risking exposure of a real credential.
Why rejection sampling instead of a simple modulo?
A plain randomByte % alphabetLength is measurably biased toward lower alphabet indices whenever the alphabet size doesn't evenly divide 256. This tool discards (rejects) any drawn value that would introduce that bias and redraws, so every character is genuinely uniform across every format.
Can I generate more than one key at once?
Yes -- set the batch count to generate several at once, useful for seeding multiple test accounts or fixtures in one pass.
How closely do these match the real formats?
They match each provider's publicly documented prefix, length and character set as closely as is publicly known -- the real issuance process (which activates a key against a real account) is not reproduced, only the visible shape.
Can I make a fully custom format?
Yes -- the Custom option lets you set any prefix, length, and character set (alphanumeric, hex, base64url, or digits only) rather than picking from a preset.
What does the entropy figure mean?
The real information-theoretic entropy (in bits) of just the random portion of the key, based on its character set size and length -- log2(alphabet size) x length, the same calculation used across this site's other generators.
Is anything generated here sent anywhere?
No. Every key is generated entirely in your browser -- this tool has no server component, and nothing is kept once you leave the page.
Theme Accent