Secret key generator
Random secrets for session keys, signing keys and API tokens, made with your browser's cryptographic random generator. Choose an encoding and a strength, then copy the value or a ready .env line.
Runs in your browser. Nothing you type is sent anywhere.
The tool is code on this page. It makes no network requests while you use it, stores nothing in cookies or local storage, and keeps working if you go offline after the page loads.
Secret key generator
Runs in your browser
Secret
.env line
How to use it
- Pick the encoding your framework or library expects. If its documentation doesn't say, Base64 and hex both work.
- Keep 256 bits unless the documentation asks for more. That is the size of an HMAC-SHA256 or AES-256 key, and far beyond what anyone can guess.
- Copy the value or the .env line and paste it straight into your secrets store or wherever you deploy from. Don't pass it through chat or email first.
- Generate a separate value for each environment and each app. A key shared between staging and production turns a staging leak into a production leak.
The same without a browser
These commands make the same kind of value on your own machine. openssl is available on macOS and Linux; Python and Node.js have their own secure generators.
openssl rand -base64 32openssl rand -base64 32 | tr -d '\n=' | tr '+/' '-_'openssl rand -hex 32LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 43; echopython3 -c "import secrets; print(secrets.token_urlsafe(32))"node -e "console.log(require('node:crypto').randomBytes(32).toString('base64'))"What makes a secret strong
Strength comes from how many different values the generator could have produced, not from how the value looks. 256 bits means 2^256 equally likely values, and no amount of computing will guess one. This page uses crypto.getRandomValues, the browser's cryptographically secure random number generator from the Web Crypto API. Letters and digits are drawn by rejection sampling, so every character is equally likely and none is favored.
The encoding doesn't change the strength
Base64, hex and letters only are different alphabets for the same random bytes. A 32-byte secret is as strong in hex, at 64 characters, as in Base64, at 44. What matters is which form your software reads. Some libraries decode Base64 into bytes, others use the text as it is; either way the text you paste carries the full randomness. Make sure every service that shares a key reads it the same way.
Presets for frameworks
Each preset produces the exact format the framework generates itself, and explains what the secret protects and what happens when you change it.
- Auth.js
AUTH_SECRETAUTH_SECRET for Auth.js, or NEXTAUTH_SECRET for NextAuth.js v4. - Django
SECRET_KEYSECRET_KEY in the alphabet of get_random_secret_key(), or letters and digits only. - Rails
SECRET_KEY_BASESECRET_KEY_BASE in the form bin/rails secret prints. - Laravel
APP_KEYAPP_KEY in the base64: format that key:generate writes. - JWT
JWT_SECRETHMAC keys for HS256, HS384 and HS512 at the sizes RFC 7518 requires.
How Crunu handles this
A separate value for every environment
In Crunu each environment has its own key, sealed separately to each person and machine allowed to read it, so a value generated for staging never travels with production. When you add a variable, Generate in the editor fills it with 40 random letters and digits right in the environment's table, so the value goes into the encrypted environment instead of through a clipboard and a chat window. The server stores values only as ciphertext.
Read about the vaultQuestions about this tool
Found a case the tool gets wrong? Write to support@crunu.com
Is it safe to generate a secret in a browser?
Yes, when the page uses the browser's cryptographic generator and sends nothing. This page calls crypto.getRandomValues and makes no network requests while you use it, which you can confirm in your browser's developer tools. If your policy says secrets must be made on the machine that uses them, use the commands above.
How long should a secret key be?
32 random bytes, or 256 bits, is enough for session secrets, HMAC signing keys and AES-256 keys. Go longer only when a format asks for it: Rails generates 64 bytes, and HS512 needs at least 64. A longer key than needed does no harm.
Base64 or hex?
Use what your software expects. If it doesn't say, either works. Hex is longer but has no characters that need quoting in a .env file, a URL or a shell.
Can I use one secret for several apps or environments?
Better not. A separate value per app and per environment means a leak in one place doesn't expose the others, and you can change one key without coordinating a change everywhere.
Does this page keep the secrets it makes?
No. A value exists only in this tab's memory until you leave or reload the page. Nothing is written to cookies, local storage or a server.
Read more
Other free tools
- .env linterFinds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- .env converterTurns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Compare two .env filesShows which variables exist in only one file and which have different values, with values hidden until you ask.
- OIDC trust policy builderTrust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- Offboarding checklist generatorPick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.