API Key Generator

Session IDs are typically opaque random strings. API keys often have a brand prefix ('sk_live_'), are segmented for readability ('xxxx-yyyy-zzzz') and sometimes carry a checksum. This tool handles all three patterns; the Session ID Generator is the simpler tool for raw tokens.

No — they share the format but the random body is generated locally. Using a Toollyz-generated key on Stripe or GitHub won't work; their backends won't recognise it. Use the format to test your own systems or to mint keys for your own API.

It's a single sum-mod-36 character we append after the body. If a user mistypes one character of the key, the checksum almost certainly won't match — useful to fail fast client-side before hitting your auth endpoint. It's not cryptographic.

Long uninterrupted strings are hard to dictate over a phone or read off a slide. Splitting into 4×6 or 5×6 with a `-` separator makes keys human-friendly without sacrificing entropy.

Alphanumeric (a-z A-Z 0-9) is the default and works everywhere. Hex is best when keys need to be all digits/lower for case-insensitive systems. Base64URL packs more entropy per character — use it when key length matters.

Yes — that's the point. Everything happens in the browser; no AI service, no API, no network call. You can disconnect from the internet and the tool still works.

For production traffic, target ≥ 128 bits of entropy — about 22 base64url chars or 32 alphanumeric chars. The strength meter shows live. Stripe-style 32-char alphanumeric keys are ~190 bits.

Never. Even though we generate them locally, treat them like any production secret — store in a secret manager, environment variable, or a vault. Don't put them in git.

Not via the UI today. Use the custom settings panel to match your format, then save it as the default in localStorage by leaving the settings active.

It's a one-character typo detector — there are only 36 possible values, so an attacker who knows the algorithm can trivially compute it. The point is catching paste errors, not preventing forgery.

No. All key minting and strength calculation runs in your browser.