Framework Secret Key Generator

// One generator, four framework contracts

A generic random string is not always ready for a framework. Django's project generator uses 50 characters from its own lowercase, digit, and punctuation pool. Laravel's default AES-256 configuration expects 32 random bytes encoded as padded Base64 and prefixed with base64:. This page reproduces those exact shapes rather than asking you to translate a generic value.

The Flask preset uses 24 random bytes rendered as 48 lowercase hexadecimal characters, a portable SECRET_KEY string with 192 bits of generated entropy. Flask accepts a long random bytes or string value rather than requiring one serialized format, so keep the generated hex unchanged when moving it into configuration.

WordPress needs a complete set of eight constants: four keys and four salts. Each value is 64 characters from the full 92-character pool used by WordPress for secret keys and salts. The output preserves the canonical constant order and produces one block for wp-config.php.

// Copy configuration without exposing the underlying secret

Every result already includes its environment variable or configuration wrapper. Copy the whole output, not only the visible random portion. Django and Flask produce SECRET_KEY assignments, Laravel produces APP_KEY=base64:..., and WordPress produces eight complete define calls.

Generation happens with crypto.getRandomValues in this browser. Values are not uploaded, placed in the URL, written to browser storage, or kept in a history. Refreshing or closing the page discards them. Clipboard managers, screen sharing, browser extensions, shell history, logs, and source control can still expose anything you copy.

For a production system, move the result directly into the deployment platform's secret storage or another approved secrets manager. Do not paste a real secret into a ticket, chat, commit, screenshot, or build log. Generate separate values for separate applications and environments.

// Rotate with the framework's fallback mechanism

Replacing a signing or encryption key is an operational change, not just a text edit. Django can verify older signatures with SECRET_KEY_FALLBACKS while a new SECRET_KEY signs new data. Flask 3.1 added a similarly named fallback list for its built-in secure cookie session, although extensions may not support it.

Laravel can try comma-separated APP_PREVIOUS_KEYS when decrypting data created with an older APP_KEY. Without a previous key, existing encrypted values become unreadable and authenticated sessions are logged out. Test the transition and retire old keys after the required migration window.

WordPress rotation replaces all eight constants together. Doing so invalidates existing authentication cookies and forces users to sign in again, which is useful after a suspected compromise but disruptive as an unplanned maintenance step.

// fair questions

Are these secrets generated on the server?

No. This page uses crypto.getRandomValues in your browser. Generated values are not sent to a generation endpoint, saved in browser storage, added to the URL, or retained in a value history. The device, browser, clipboard, and destination still need to be trusted.

Why does a Laravel APP_KEY start with base64:?

Laravel's key generator creates the byte length required by the configured cipher, Base64-encodes those bytes, and adds the base64: prefix so the framework knows how to decode the stored value. The default AES-256 configuration uses 32 bytes, so this preset emits that exact form.

Why is the Django SECRET_KEY 50 characters?

Django's own project utility returns 50 characters from a fixed 50-character set of lowercase letters, digits, and selected punctuation. This preset uses the same length and ordered pool with unbiased sampling from the browser's cryptographic random source.

Does Flask require exactly 24 random bytes?

No. Flask requires a long random bytes or string value and does not mandate one text encoding. This preset follows the audited 24-byte hex recipe, producing a portable 48-character string with 192 bits of generated entropy. Keep it secret and stable for the lifetime of signed sessions unless you plan a rotation.

Do I need all eight WordPress keys and salts?

Yes. A complete current wp-config.php block contains AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and the matching four SALT constants. Copy the full generated block and replace the existing eight definitions together.

Can I generate several secrets at once?

Yes. Choose five or ten outputs to create a fresh batch in the selected framework format, then copy each result or the complete batch. Each WordPress result is its own complete eight-constant block. Use separate values for separate applications and environments.