Generate a Django SECRET_KEY
A 50-character key drawn from the same alphabet as Django's own get_random_secret_key(), so it passes the security.W009 deployment check. Or choose letters and digits only, if your deployment tooling trips over symbols.
Runs in your browser. Nothing you type is sent anywhere.
The tool is code on this page. It makes no network requests while you use it, stores nothing in cookies or local storage, and keeps working if you go offline after the page loads.
Secret key generator: Django
Runs in your browser
Secret
.env line
At a glance
- Variable
- SECRET_KEY setting, usually read from an environment variable
- Format
- 50 characters; Django's alphabet adds !@#$%^&*(-_=+)
- Randomness
- 282 bits, 297 bits
- Requirement
- security.W009: at least 50 characters, 5 different ones, no django-insecure- prefix
Django's alphabet includes #, $ and &. In a .env file the value goes in single quotes: an unquoted # starts a comment for many dotenv loaders, and $ is expanded by shells and Docker Compose. The .env line above is already quoted.
The same without a browser
python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"python -c "import secrets, string; a = string.ascii_letters + string.digits; print(''.join(secrets.choice(a) for _ in range(50)))"What the secret protects
Django uses SECRET_KEY for all sessions unless you use the cache session backend without the default session auth hash, for messages stored in cookies, for password reset tokens, and for any cryptographic signing that doesn't name another key. Django refuses to start without it, and its documentation warns that a known SECRET_KEY can lead to privilege escalation and remote code execution.
What breaks when you change it
Everything signed with the old key becomes invalid: users are signed out, password reset links stop working, and signed cookies and messages are rejected. User passwords are not affected, because Django doesn't use the secret key for them.
Changing it without signing everyone out
Set the new value as SECRET_KEY and move the old one to the start of SECRET_KEY_FALLBACKS. Django signs with the new key and still accepts values signed with the fallbacks. Remove old keys from the end of the list once you're ready to expire the sessions and reset links that use them; each fallback adds work to every check that doesn't match an earlier key.
How Crunu handles this
A separate value for every environment
In Crunu each environment has its own key, sealed separately to each person and machine allowed to read it, so a value generated for staging never travels with production. When you add a variable, Generate in the editor fills it with 40 random letters and digits right in the environment's table, so the value goes into the encrypted environment instead of through a clipboard and a chat window. The server stores values only as ciphertext.
Read about the vaultQuestions about this tool
Found a case the tool gets wrong? Write to support@crunu.com
Can I use the key that startproject put in settings.py?
Not in production. Keys generated by startproject start with django-insecure-, which is how security.W009 recognizes them. Generate a new key, keep it out of the repository, and read it from the environment.
Is a letters-and-digits key weaker?
No. 50 characters from 62 letters and digits carry about 297 bits of randomness, slightly more than 50 characters from Django's 50-character alphabet. It also avoids quoting problems in .env files and shell scripts.
My key leaked. What now?
Generate a new one and move the leaked key to SECRET_KEY_FALLBACKS only if you must keep sessions alive for a short while; otherwise drop it at once. Anyone holding the old key can forge signed values until it's gone from both settings.
Read more
Other free tools
- .env linterFinds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- .env converterTurns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Compare two .env filesShows which variables exist in only one file and which have different values, with values hidden until you ask.
- OIDC trust policy builderTrust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- Offboarding checklist generatorPick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.