When to use this tool
An IndexNow key is an ownership proof: a random string you publish on your own host so search engines can confirm a submission comes from someone who controls that host. You need a new key in a few situations.
Setting up a new host
Every hostname you submit URLs for needs a key file it can serve. A staging domain and a production domain are two different hosts.
Rotating after a mistake
The key is public, but a key file that also exists on a domain you do not control is worthless. Generate a new one and remove the old file.
Separating environments
Distinct keys per environment make it obvious which system submitted a batch when you audit logs later.
Replacing a weak key
Short or guessable keys either fail the protocol's 8–128 character rule or make the file trivial to reproduce. A generated key avoids both.
How to generate and install a key
The key never leaves your browser: it is produced with the Web Crypto API and the download is assembled locally.
- 1
Generate the key
You get a 32-character hexadecimal string — well inside the protocol's 8–128 character limit, and made only of characters IndexNow accepts.
- 2
Download the text file
The file is named <key>.txt and contains the key and nothing else. Extra content is the single most common cause of a 403.
- 3
Upload it to your host root
Serve it at https://your-host/your-key.txt as text/plain. Confirm it is not behind auth, a redirect, or a bot-protection challenge.
- 4
Verify, then submit
Run the key checker against the live URL before your first batch. Once it passes, paste the same key into the submission form.
What usually goes wrong
The file contains more than the key
A trailing newline is fine; a template wrapper, JSON, or an HTML page is not. The file body must equal the key.
The host serves a soft 404
Many frameworks answer unknown paths with a 200 and the app shell. Search engines then read HTML instead of the key and reject the batch.
The key is treated as a secret
Putting the file behind auth or blocking it in robots rules defeats its purpose — verification is an unauthenticated HTTP fetch.
One key reused without the file
Each host must serve its own copy. A key that validates on example.com does not authorise blog.example.com.
Frequently asked questions
- How long should an IndexNow key be?
- Between 8 and 128 characters, using letters, digits and dashes. This tool produces 32 hexadecimal characters — long enough to be unguessable, short enough to stay readable in logs.
- Can I write the key myself?
- Yes. Any string within the character and length rules works. A generated key simply avoids accidentally picking something short or predictable.
- Does the file name have to match the key?
- Only if you rely on the default location. If you host the file elsewhere, pass that URL as keyLocation when you submit — it must still be on the same host.
- Is the key sent to submitnow when I generate it?
- No. Generation and download happen entirely in your browser; there is no network request at all.
- How often should I rotate the key?
- There is no expiry. Rotate only when you need to invalidate an old file, and remember to delete the previous key file afterwards.