Auth Secret

Auth Secret Generator

Cryptographically secure secrets for sessions, JWTs, APIs, and any app that needs a strong secret. Pick a length, copy an env line, or call the public API and MCP server. Generation in the browser never leaves your device.

Do

  • Keep secrets in environment variables or a secret manager
  • Use a different secret per environment
  • Rotate after a leak or staff change

Don't

  • Commit secrets to version control
  • Ship them in client-side JavaScript
  • Reuse one secret across apps or customers

FAQ

Which length should I use?

32 bytes (256 bits) is the usual recommendation, including openssl rand -base64 32. Longer values add entropy but are rarely required.

Is this as strong as OpenSSL?

Yes. The browser and API both use a CSPRNG. Encoding (base64 vs hex) does not change the entropy — only the string shape.

Can I use this in production?

Yes. Prefer the on-page generator so the value never leaves your device. The API is for CI and agents; responses are not stored.