Secret Key Generator for .env, JWT and Webhooks
Generate random secret keys in your browser for NUXT_SESSION_PASSWORD, Better Auth, JWT and webhook signing, as hex, base64, base64url or letters and digits.
- Runs in your browser
Checked
01Tool
Tool
Characters
64
Entropy
256 bits
Bytes
32
Secrets appear here once the page has loaded.
openssl rand -hex 3202Guide
How it works
Bytes, not characters
A secret is only as strong as the randomness behind it. The generator draws bytes, then writes them as text. Hex spends two characters on each byte and base64 four on every three bytes, while each A-Za-z0-9 character carries about six bits. The readout above the secret shows characters, bits and bytes, so a 32-character limit and a 256-bit limit can both be checked at a glance.
Pick the encoding the variable expects
- base64url has no
+,/or=, so it survives URLs, cookies and shell quoting. It suitsNUXT_SESSION_PASSWORDand JWT keys. - base64 matches
openssl rand -base64 32, the command Better Auth suggests. - hex matches
openssl rand -hex 32and anything that reads a key as hex. - A-Za-z0-9 fits a field that rejects symbols, such as a webhook signing secret you paste into a dashboard. Each character is drawn without bias: bytes from 248 up are thrown away, so all 62 symbols are equally likely.
What each preset asks for
| Variable | Asks for | Who sets it |
|---|---|---|
NUXT_SESSION_PASSWORD | 32 characters | nuxt-auth-utils |
BETTER_AUTH_SECRET | 32 characters, high entropy | Better Auth |
| JWT key, HS256 | 256 bits | RFC 7518 |
| JWT key, HS512 | 512 bits | RFC 7518 |
| Lemon Squeezy signing secret | 6 to 40 characters | Lemon Squeezy |
| GitHub webhook secret | High entropy | GitHub |
nuxt-auth-utils writes a session password into .env on its own in development. Production is where you need to set one yourself.
Put it on Cloudflare Workers
Locally, the .env line goes in .env or .dev.vars. Wrangler reads only one of them: once .dev.vars exists, values in .env stop reaching your Worker. A deployed Worker gets the value from wrangler secret put, and after that neither Wrangler nor the dashboard shows it again, so keep a copy wherever your team keeps credentials.
Rotate without surprises
A session secret can't be swapped quietly, since every cookie sealed with the old one stops opening. Webhook secrets are easier: set the new one at the provider and in your Worker at the same time, and expect a few deliveries to fail in between.
03Questions
Questions
- How long should a secret key be?
- At least 32 random bytes for anything that signs sessions or tokens. That is 256 bits, the minimum RFC 7518 sets for an HS256 JWT key, and it clears the 32-character minimum that nuxt-auth-utils and Better Auth ask for in every encoding.
- What is the difference between 32 bytes and 32 characters?
- Bytes measure randomness and characters measure the text. 32 random bytes are 64 characters in hex, 44 in base64 and 43 in base64url. 32 characters of hex hold only 16 bytes, so a library that counts characters can accept a secret with half the strength you meant.
- Is it safe to generate a secret key in the browser?
- Yes, when the page uses the Web Crypto API. This one reads its bytes from crypto.getRandomValues, the browser's cryptographically secure generator, and sends nothing anywhere. The secrets live only in this tab and are gone when you leave the page.
- How do I store a secret on Cloudflare Workers?
- Run npx wrangler secret put with the variable's name and paste the value when Wrangler asks for it. Wrangler encrypts it, and neither Wrangler nor the dashboard shows it again. For local development, put it in .dev.vars or .env, but not both.
- Can I use Math.random() to make a secret?
- No. Math.random() is not a cryptographic generator, and its output can be predicted from earlier values. Use crypto.getRandomValues in a browser or a Worker, or crypto.randomBytes in Node.
- What happens when I change a session secret?
- Every session signed with the old one stops working, so everyone is signed out. Change it when it may have leaked, and expect the sign-outs. Better Auth can roll over gradually with its BETTER_AUTH_SECRETS option.
04Sources
Sources
Every fact on this page was read from these pages on .
- Nuxt docs, Sessions and authenticationnuxt.com/
docs/ 4.x/ guide/ recipes/ sessions-and-authentication - Better Auth docs, Installationbetter-auth.com/
docs/ installation - RFC 7518, section 3.2, HMAC with SHA-2 functionsrfc-editor.org/
rfc/ rfc7518#section-3.2 - Lemon Squeezy docs, Signing requestsdocs.lemonsqueezy.com/
help/ webhooks/ signing-requests - GitHub docs, Validating webhook deliveriesdocs.github.com/
en/ webhooks/ using-webhooks/ validating-webhook-deliveries - Cloudflare Workers docs, Secretsdevelopers.cloudflare.com/
workers/ configuration/ secrets/ - MDN, Crypto.getRandomValues()developer.mozilla.org/
en-US/ docs/ Web/ API/ Crypto/ getRandomValues
Found something out of date? Tell us.
Nuxter
Building a SaaS on Nuxt?
Nuxter signs sessions with nuxt-auth-utils, so NUXT_SESSION_PASSWORD is the one secret every deploy needs, and its analytics salt falls back to it. Its Lemon Squeezy adapter checks each webhook with a signing secret you choose, and this page writes that too.