Prototype API key formats with prefixes and grouped blocks

Design considerations

• Prefixes like `sk_live_` or `pk_test_` make environments visible
• Keep a short prefix visible in logs but truncate the rest
• Consider a checksum for typo detection (not included here by default)
• Target at least 128 bits of entropy

What makes an API key secure — length is entropy

The strength of an API key comes from its random body, not its prefix. With a character set of size C and body length L, entropy is L × log₂(C) bits. A 32-character body over uppercase + lowercase + digits (62 characters) yields about 190 bits — practically immune to brute force.

A common baseline is 128 bits or more. Over a 62-character set that means a body of at least 22 characters; if you exclude look-alike characters and shrink the set, adding 2–3 characters of length restores the same strength.

Prefix conventions — the key to leak detection

Prefixes that identify the service and environment — Stripe's sk_live_ / sk_test_, GitHub's ghp_ — are more than a readability aid. A distinctive prefix lets tools like GitHub secret scanning detect keys committed by accident and revoke them automatically.

Always separate production and test keys by prefix. When a fragment of a key ends up in a log or error message, the prefix tells you immediately which environment was exposed.

Storage & operations checklist

• Store a hash (SHA-256) of the key server-side instead of the plaintext; show the plaintext only once at issue time
• Track an expiry date and last-used timestamp per key, and revoke unused keys regularly
• Never hardcode keys in code or config files — use environment variables or a secret manager
• Prepare a rotation procedure in advance so a leaked key can be revoked immediately

FAQ

Q. Are generated keys sent to a server? No. Every key is generated locally with the browser's Web Crypto API (crypto.getRandomValues); nothing leaves your machine.

Q. How long should an API key be? At least 22 random characters (about 128 bits of entropy). For keys that are exposed externally, 32 characters (about 190 bits) gives comfortable margin.

Q. Can I use a UUID as an API key? UUID v4 carries 122 bits of entropy, which clears the baseline, but it cannot carry a prefix and its format is widely known, making secret-scanning detection harder. A dedicated random key format is preferable.

Q. Can keys from this tool be used in production? Generation itself uses a cryptographically secure random source, so yes. That said, production keys are best issued by a server-side system that records issuance and revocation; this tool is ideal for format design, staging, and testing.

Pairs well with

Jump to other JSON2Class utilities that naturally follow this one.