How to Generate a Secure API Key or Secret (Length, Encoding, and Storage)

API keys, session tokens, and signing secrets are all just random values that must be impossible to guess. Generating them well is straightforward, but a few common shortcuts, such as using a weak random function, undermine everything.

How much randomness do you need?

Aim for at least 128 bits of entropy, and 256 bits (32 random bytes) is a comfortable default for long-lived secrets. That is far beyond what can be brute-forced.

• 16 bytes = 128 bits: 32 hex characters, or 22 base64url characters.
• 32 bytes = 256 bits: 64 hex characters, or 43 base64url characters.

Use a cryptographically secure generator

// Node.js
require("crypto").randomBytes(32).toString("hex")

// Browser
const a = new Uint8Array(32); crypto.getRandomValues(a);

# Python
import secrets; secrets.token_urlsafe(32)

# Shell
openssl rand -hex 32

Encoding and format

• Hex is simple and safe everywhere but longer.
• Base64url packs more entropy per character and is safe in URLs and headers.
• A readable prefix (like sk_live_ or ghp_) helps people and scanners recognize a key and tell environments apart. The prefix isn't part of the secret's strength.
• Consider including a short key ID separate from the secret so you can look keys up without storing the secret itself.

Storing and handling keys

1. 1Show the full key to the user only once, at creation.
2. 2Store only a hash of the key on the server (a fast hash like SHA-256 is fine for high-entropy random keys, unlike passwords).
3. 3Compare using a constant-time comparison to avoid timing leaks.
4. 4Keep secrets out of source control, client-side code, and logs; use environment variables or a secrets manager.
5. 5Support rotation and revocation: keys should be replaceable and expire when appropriate.

If a key leaks

Revoke it immediately, issue a new one, and review access logs for misuse. Removing it from a public repository after the fact doesn't un-leak it.

When you generate keys with an online tool, choose one that creates them in your browser using the Web Crypto API so the value is never transmitted.