OneTaskBy Tim King · Updated
API Key Generator
Base62 Key Bodies With Stripe, GitHub or Slack Prefixes and CRC32 Checksums
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the API Key Generator works
This API key generator creates keys in the style used by GitHub, Stripe and Slack: a short prefix that
names the service and key type, a long random base62 body, and an optional six-character checksum. Type
a prefix such as myapp_live_, set the length, and generate as many keys as you need.
Anatomy of a key from the API key generator
A key like myapp_live_r3kP3EnIh6oQEm9vccSC4tF6CNPFvO1t1QvL has three parts. The prefix tells a
person, a log reader or a secret scanner what the key is for. The body holds the randomness: 30 base62
characters carry about 178 bits, far beyond guessing. The last six characters are the CRC32 of the body
in base62.
Why add a checksum
The checksum lets your server reject a mistyped or truncated key without a database lookup. It also lets secret scanning tools, including GitHub's push protection, confirm that a string is really one of your keys before raising an alert, which cuts false positives. It adds no security itself.
Storing keys safely
Show the full key to the user once, then store only a hash of it, such as SHA-256, with the prefix and the last few characters kept for display. Unlike passwords, random API keys do not need a slow hash, because they are too long to guess. If your database leaks, the hashes cannot be used as keys.
FAQ
What prefix should I use?
Something unique to your product plus the key type, ending in an underscore: acme_pk_ for a public key
and acme_sk_ for a secret one, or _test_ and _live_ for environments. A distinctive prefix makes leaked
keys easy to find with a simple search or a scanner rule.
Why base62 and not Base64?
Base62 uses only letters and digits, so a double-click selects the whole key and it survives URLs, shell commands and spreadsheets without escaping. Characters are chosen by rejection sampling, so every one of the 62 is equally likely and no bias creeps in.
How long should the key be?
Anything over 128 bits of randomness is enough; 22 base62 characters reach that. The default of 30 gives generous margin. Longer keys cost nothing except a few bytes, so pick a length that fits any column or header limits in your system.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Random String Generator
Cryptographically random strings in any length and character set.
AES Key Generator
Random AES-128, 192 or 256-bit keys in hex, Base64 or JWK.
OAuth State And Nonce Generator
Random OAuth state and OpenID nonce values for sign-in testing.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.