Skip to content
Sign in
Buy Nuxter

Auth

NUXT_SESSION_PASSWORD Generator

Generate a NUXT_SESSION_PASSWORD for nuxt-auth-utils in your browser, 32 random bytes as base64url, with the .env line and the wrangler secret command.

  • Runs in your browser

Checked

01Tool

Tool

Encoding
For .env and Wrangler

Characters

43

Entropy

256 bits

Bytes

32

Secrets appear here once the page has loaded.

Same thing from a terminal
node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
Secrets are made in this tab with crypto.getRandomValues. Nothing is sent, stored or put in the address, and they are gone when you leave the page.

02Guide

How it works

Where nuxt-auth-utils uses it

nuxt-auth-utils seals the session into an encrypted cookie with this password, so the server can read it back without a database lookup. Anyone who has the password can forge a session, which is why it belongs in a secret and never in your repository.

Why base64url

base64url has no +, / or =, so the value pastes into .env, a shell or a dashboard without quoting. 32 random bytes make 43 characters, past the 32-character minimum.

One value for every instance

Every Worker and every preview that serves the same users must share the password, or a session made by one will not open on another. Set it once per environment with wrangler secret put, and give staging its own.

03Questions

Questions

How long does NUXT_SESSION_PASSWORD need to be?
At least 32 characters, as the Nuxt docs say. This page makes 32 random bytes written as 43 base64url characters, which clears the minimum with room to spare.
Do I need to set it in development?
No. When it is missing, nuxt-auth-utils adds one to your .env the first time you run the dev server. You need your own in production, and every instance of the app must share it.
What happens if I change it?
Every session sealed with the old password stops opening, so everyone is signed out and has to sign in again.
How do I set it on Cloudflare Workers?
Run npx wrangler secret put NUXT_SESSION_PASSWORD and paste the value at the prompt. Wrangler stores it encrypted, and it reaches your app as the runtime config's session password.

04Sources

Sources

Every fact on this page was read from these pages on .

  1. Nuxt docs, Sessions and authenticationnuxt.com/docs/4.x/guide/recipes/sessions-and-authentication
  2. Cloudflare Workers docs, Secretsdevelopers.cloudflare.com/workers/configuration/secrets/
  3. MDN, Crypto.getRandomValues()developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues

Found something out of date? Tell us.

05Related

Related tools

All tools

Nuxter

Building a SaaS on Nuxt?

Nuxter signs its sessions with nuxt-auth-utils, so this is the one secret every Nuxter deploy needs. Its analytics salt falls back to it when you don't set one of your own.

See what Nuxter includesFrom $249, one-time.