Project Secrets Generator
Free project secrets generator — Django SECRET_KEY, Rails secret_key_base, JWT signing secrets, session keys and more, each at the right length and encoding, downloadable as a .env file. Generated locally; nothing is uploaded.
Loading engine…
Runs entirely in your browser — nothing you enter is uploaded or stored.
Every secret a new project needs, at once
Starting a project means generating a handful of unrelated secrets in the right formats. Each one is trivial on its own; collectively it is a chore, and chores get shortcuts — the same string pasted into four variables, or a memorable one typed by hand.
Why they should all differ
Distinct secrets bound the damage. If a session key leaks, you rotate it and users log in again; if that key was also your JWT signing secret and your database encryption key, you are rotating everything at once, under pressure, in production. The cost of keeping them separate is one click.
Rotate, do not hide
If a secret reaches a repository, rewriting history does not undo it. The value is in clones, in forks, in CI logs and in whatever scraped the repo before you noticed. The only response that works is to rotate the secret and treat the old one as public.
Frequently asked questions
What are these presets?
The secrets common frameworks and services expect, each generated at the length and encoding that framework actually wants — a Django SECRET_KEY, a Rails secret_key_base, a JWT signing secret, a session key, and so on. The formats differ, and using the wrong one usually fails loudly but sometimes fails quietly.
Can I just use the same random string everywhere?
You can, and you should not. Separate secrets mean a leak is contained: rotating a session key does not invalidate your API tokens, and a compromised third-party integration does not hand over your signing key. It costs nothing to keep them distinct, which is the whole argument.
How do I store them?
In environment variables or a secrets manager, never in the repository. If one ends up committed, rotate it rather than deleting the commit — the history is already on someone's laptop and possibly in a fork. Treat a leaked secret as leaked.
Are these generated locally?
Yes — a WebAssembly module in this page, seeded from the browser CSPRNG. Nothing is transmitted. Reload and every value is different.