When an application only needs to check an API key, store a verifier instead of the reusable plaintext key. A database leak then does not directly reveal the original credentials. The trade-off is added verification work—but the available Cloudflare documentation gives no numeric API-key hashing latency, so the cost has to be measured in the target runtime.
What hashing an API key at rest does
A verifier is a one-way result derived from a presented key. At authentication time, the service derives a result from the incoming key and compares it with the stored verifier. If an attacker obtains only the verifier database, the original key is not directly exposed as it would be in a plaintext database.
As an Amazon Associate I earn from qualifying purchases.
This reduces one consequence of a database breach; it does not make the verifier store harmless. Restrict access to it, protect backups, and avoid logging presented keys. An attacker with the verifier data may still attempt guesses, and any compromised live key should be revoked or rotated.
Recommended Free Tools
Choose storage according to key entropy and use
| Credential and need | Practical approach | Important qualification |
|---|---|---|
| Random, high-entropy API key; verification only | Store a fast keyed verifier, such as HMAC-SHA-256, and keep its secret key separate from the verifier database. | This is an engineering design choice, not a direct NIST API-key mandate. HMAC is a keyed hash construction; see the NIST SP 800-224 initial public draft. |
| Human-selected password or short lookup secret | Use a salted password-hashing scheme designed to make guessing costly. | Password and lookup-secret guidance does not automatically apply to every generated API key. |
| Application must retrieve and transmit the original credential later | Encrypt the credential and manage the encryption key separately. | A one-way verifier cannot recover the original value. |
Why a generated API key differs from a password
Password hashing deliberately raises the cost of each guess because people often choose predictable passwords. A properly generated, high-entropy machine token has a much lower guessing risk than a human password. Applying a deliberately expensive password hash to such a token can add work without providing the same practical benefit. This depends on how keys are generated and protected; a short or user-chosen “API key” should not be treated as high entropy merely because of its label.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What NIST does—and does not—say
NIST SP 800-63B Revision 4 addresses password verifiers: it calls for salted password hashing, a work factor as high as practical without harming verifier performance, and records that identify the scheme and cost factor to support migration. It also describes an optional additional keyed-hash or encryption step with a secret kept separately from the verifier. These are password-verifier recommendations, not a universal rule that API keys must use password hashing. Read the guidance in its stated scope in NIST SP 800-63B Revision 4.
NIST’s 2026 implementation conformance resource specifies a 112-bit threshold for its look-up-secret storage criteria: lookup secrets below that threshold are to use salted password hashing, with a stated minimum salt length of 32 bits for that case. Those figures apply to the specified lookup-secret criteria, not to every API-key design; they are security-strength and salt requirements, not latency measurements. See the NIST SP 800-63-4 conformance criteria.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When hashing is the wrong storage model
If a service must later send the original credential to another system, hashing cannot meet that requirement: the original value cannot be derived from a verifier. Use encryption for recoverable secrets, with the encryption key managed separately and access limited to the components that need to decrypt. Do not keep the recoverable credential in plaintext merely because the application also performs authentication checks.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat is known about edge-function latency
Cloudflare Workers documents Web Crypto support for SHA-256, HMAC, and PBKDF2, and states that cryptographic operations through Web Crypto are significantly faster than performing them purely in JavaScript. Its documentation does not provide a numeric API-key verification benchmark or a p50/p95 latency premium. That platform statement is not a measurement for a particular key, code path, or deployment, and it should not be generalized to other edge runtimes. See Cloudflare Workers Web Crypto.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For generated high-entropy keys, a fast keyed digest such as HMAC-SHA-256 is a plausible design when verification is the only need. Cloudflare provides a Worker example of HMAC with SHA-256 in its request-signing example. That example demonstrates API support, not API-key authentication performance or a standards requirement.
How to measure the cost in your deployment
Benchmark the production-compatible runtime and the real authentication path. A digest-only microbenchmark will not reveal whether database access, key setup, or network time dominates a request.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Use the production code path. Run the intended runtime with the actual key length, algorithm, storage lookup, and request shape. Include key import or setup if it happens per request.
- Separate one-time and per-request work. Record initialization separately from verification so warm invocations do not conceal cold-start or first-use costs.
- Compare against a baseline. Measure the same path without hashing, then with verifier computation and comparison. Keep the lookup and other work equivalent.
- Break down timings. Record cryptographic CPU duration, database time, network time, and total request duration independently.
- Test warm and cold execution under representative concurrency. Report sample count and p50 and p95 results for each condition; repeat runs to check whether the pattern holds.
The result is meaningful only for that runtime, algorithm, key setup behavior, storage path, and workload. The available official sources do not establish a universal latency premium for API-key hashing at the edge.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep verifier secrets out of the verifier database
With a keyed verifier, the HMAC secret is a separate security boundary: a database-only compromise should not include that key. Store it in the platform’s protected secret mechanism, limit which code can access it, and plan how to rotate it. Cloudflare advises storing sensitive values such as API keys and authentication tokens as Worker secrets rather than plaintext environment variables; a Worker can access the secret programmatically. See Cloudflare Workers Secrets.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Cloudflare’s Secrets Store overview describes account-level secrets encrypted and stored across its data centers, compatibility with Workers and AI Gateway, and labels the service open beta. Product status can change; check the current Cloudflare Secrets Store overview before relying on that specific service. The broader design principle is to keep verifier data and the secret needed to key it under separate controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
