Generate a Rails secret_key_base
128 hexadecimal characters, or 64 random bytes, the same form bin/rails secret prints. Set it as SECRET_KEY_BASE, or keep it as secret_key_base in your encrypted credentials.
Runs in your browser. Nothing you type is sent anywhere.
The tool is code on this page. It makes no network requests while you use it, stores nothing in cookies or local storage, and keeps working if you go offline after the page loads.
Secret key generator: Rails
Runs in your browser
Secret
.env line
At a glance
- Variable
- SECRET_KEY_BASE, or secret_key_base in credentials
- Format
- 64 random bytes as 128 hex characters
- Randomness
- 512 bits
- Requirement
- Rails asks for secrets that are long and random
The same without a browser
bin/rails secretopenssl rand -hex 64What the secret protects
secret_key_base is the input to your app's key generator, which derives the keys of every MessageVerifier and MessageEncryptor, including the ones that sign and encrypt cookies. The default cookie session store depends on it for both integrity and confidentiality. Rails looks for it first in ENV["SECRET_KEY_BASE"], then in credentials.secret_key_base; in development and test it generates one and keeps it in tmp/local_secret.txt.
What breaks when you change it
The Rails security guide says a new secret_key_base expires active sessions and requires every user to sign in again, and that encrypted cookies, signed cookies and Active Storage files may also be affected.
Changing it with less disruption
Rails can read cookies written under an older configuration through config.action_dispatch.cookies_rotations; the security guide shows it for moving signed cookies to a new digest. Check the guide for your Rails version before relying on rotations for a new secret_key_base. Otherwise, change it at a quiet hour and expect everyone to sign in again.
How Crunu handles this
A separate value for every environment
In Crunu each environment has its own key, sealed separately to each person and machine allowed to read it, so a value generated for staging never travels with production. When you add a variable, Generate in the editor fills it with 40 random letters and digits right in the environment's table, so the value goes into the encrypted environment instead of through a clipboard and a chat window. The server stores values only as ciphertext.
Read about the vaultQuestions about this tool
Found a case the tool gets wrong? Write to support@crunu.com
Credentials or an environment variable?
Either works. The Rails API documentation says the correct place for most apps is the encrypted credentials file; SECRET_KEY_BASE takes precedence when set, which suits platforms that inject secrets as environment variables. Don't keep both with different values, or you'll debug the wrong one.
My Docker build fails because secret_key_base is missing. Do I need the real one?
No. For asset precompilation, set SECRET_KEY_BASE_DUMMY=1 in the build step and Rails generates a throwaway value, so the real secret never ends up in an image layer.
Why 64 bytes?
It's what bin/rails secret produces: SecureRandom.hex(64). Rails derives fixed-size keys from it, so a longer value doesn't make those keys longer; 512 random bits simply leave nothing to guess.
Read more
Other free tools
- .env linterFinds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- .env converterTurns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Compare two .env filesShows which variables exist in only one file and which have different values, with values hidden until you ask.
- OIDC trust policy builderTrust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- Offboarding checklist generatorPick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.