Generate a NEXTAUTH_SECRET (AUTH_SECRET)
A random secret for Auth.js and NextAuth.js: 33 random bytes in Base64, the same as the openssl command in the Auth.js docs. Put it in AUTH_SECRET, or in NEXTAUTH_SECRET if you're still on NextAuth.js v4.
Runs in your browser. Nothing you type is sent anywhere.
The tool is code on this page. It makes no network requests while you use it, stores nothing in cookies or local storage, and keeps working if you go offline after the page loads.
Secret key generator: Auth.js
Runs in your browser
Secret
.env line
At a glance
- Variable
- AUTH_SECRET; NEXTAUTH_SECRET on NextAuth.js v4
- Format
- 33 random bytes in Base64: 44 characters, no padding
- Randomness
- 264 bits
- Requirement
- Auth.js recommends at least 32 random characters
The same without a browser
npm exec auth secretopenssl rand -base64 33What the secret protects
Auth.js uses the secret to encrypt cookies and tokens, and its reference describes it as the string used to hash tokens, sign cookies and generate cryptographic keys. When sessions are JWTs, the session cookie itself is encrypted with a key derived from it. The deployment guide calls AUTH_SECRET the only strictly required environment variable, and asks for the same value on your stable deployment and on any preview deployment that needs OAuth sign-in.
What breaks when you change it
Cookies and tokens encrypted with the old secret can no longer be read. With JWT sessions, that signs everyone out at once. With database sessions the sessions themselves survive, but tokens hashed with the old secret, such as email sign-in links that are still pending, stop working.
Changing it without signing everyone out
The secret option accepts an array. Put the new secret first and keep the old one after it: Auth.js encrypts new sessions with the first secret and tries each secret in turn to read existing ones. Once the longest session has expired, remove the old secret.
How Crunu handles this
A separate value for every environment
In Crunu each environment has its own key, sealed separately to each person and machine allowed to read it, so a value generated for staging never travels with production. When you add a variable, Generate in the editor fills it with 40 random letters and digits right in the environment's table, so the value goes into the encrypted environment instead of through a clipboard and a chat window. The server stores values only as ciphertext.
Read about the vaultQuestions about this tool
Found a case the tool gets wrong? Write to support@crunu.com
What's the difference between AUTH_SECRET and NEXTAUTH_SECRET?
Same purpose, different versions. Auth.js, the library NextAuth.js became in version 5, reads AUTH_SECRET and recommends the AUTH_ prefix for all its variables. NextAuth.js v4 reads NEXTAUTH_SECRET. The value is the same kind of random string either way.
Why 33 bytes and not 32?
33 bytes encode to exactly 44 Base64 characters with no = padding, which is what openssl rand -base64 33 in the Auth.js docs produces. It also clears the docs' recommended minimum of 32 characters with room to spare. 32 bytes would work just as well.
Do I need a different secret for development?
Yes. Use one value per environment, so a development secret pasted into a test or a screenshot can't decrypt production cookies.
Read more
Other free tools
- .env linterFinds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- .env converterTurns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Compare two .env filesShows which variables exist in only one file and which have different values, with values hidden until you ask.
- OIDC trust policy builderTrust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- Offboarding checklist generatorPick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.