$ loading▍
$ loading▍
Random secrets for AUTH_SECRET, JWT signing, sessions, webhooks, API keys, Laravel and Django, in hex, base64 or base62, ready to paste into your .env.
What is it for?
generating…
same as npx auth secret
Adjust
Encoding
AUTH_SECRET, JWT, session and webhook secrets, AES keys, Laravel and Django keys, API keys and UUIDs, sized the way each one expects.
Copy the key or a whole KEY=value line. Values with shell-special characters are quoted so dotenv reads them correctly.
Keys come from the browser's cryptographic random generator. The equivalent openssl command is shown, so you can reproduce it in a terminal.
// faq
Pick the “Auth.js AUTH_SECRET” preset and copy the .env line. It is 32 random bytes in base64, the same thing `npx auth secret` and `openssl rand -base64 32` produce.
At least as long as the hash: 256 bits (32 bytes) for HS256 and 512 bits (64 bytes) for HS512, as RFC 7518 requires. Shorter secrets can be brute-forced from a single signed token.
They are different ways of writing the same random bytes. Hex uses 0-9a-f and is twice as long as the data; base64 is shorter but uses + / =; base64url swaps those for URL-safe - and _; base62 uses only letters and digits, which is handy for API keys and anything copied by double-click.
Keys are generated locally with crypto.getRandomValues and never leave this page. If your policy requires secrets to be created on the server they are used on, run the openssl command shown under the key instead; the result is equivalent.
Not for signing or encryption. A v4 UUID has 122 random bits and a fixed format, which is fine for unguessable IDs, but secrets should be full-strength random keys from one of the other presets.
Put it in your environment (a .env file that is listed in .gitignore, or your host's secret settings), never in source control. Use a different secret per environment, and rotate it if it ever leaks.
Looking for something bigger? The products are full apps: an encrypted password vault, self-hosted CI/CD, and more.