About apikey.tools
apikey.tools is an independent collection of 64 developer tools for generating, inspecting and protecting API keys, tokens and secrets — every one of which runs entirely in your browser.
Who builds it
The site is designed, written and maintained by Abdessamad Bettal, a software engineer who works on APIs, authentication and the infrastructure around them. Each tool exists because it answers a question that comes up when building or operating a real API: what a key should look like, why a signature does not verify, or what to do when a secret leaks.
Why everything runs in the browser
Most online tools for keys and tokens send what you paste to a server. For a credential, that is the incident. The tools here use the browser's own Web Crypto API, so a key you generate or a token you decode never leaves your device. That claim is checkable: how it works explains exactly what runs where and how to verify it in fifteen seconds.
How the content is written
- Primary sources first.Formats, algorithms and header layouts are checked against the relevant RFCs and the providers' own documentation.
- Tested against the real thing.Hashes, HMACs and signatures are verified against published test vectors and against the providers' SDKs.
- Limits stated plainly. When a browser cannot do something properly — bcrypt, Argon2, true burn-after-reading — the page says so instead of approximating it.
- Dated and maintained. Every tool and guide shows when it was last updated.
Corrections
Security guidance that is wrong is worse than none. If you find an error — an outdated key format, a provider that changed its signing scheme, a claim that does not hold — please report it so it can be fixed and dated.