Django Secret Key Generator
Django Secret Key Generator — generated on your device, never transmitted.
Paste into your .env:
This generates a 50-character SECRET_KEY using the same alphabet Django’s own get_random_secret_key() uses, so what you get is indistinguishable from running the management command. It is produced by your browser’s CSPRNG and never transmitted anywhere.
Frequently Asked Questions
Is it safe to generate a secret key on a website?
It is here, because nothing is transmitted. The key is produced by crypto.getRandomValues inside your own browser — the same cryptographic generator your operating system uses — and never touches the network. You can disconnect from the internet and this page still works, which is the simplest way to prove it.
What does Django use SECRET_KEY for?
It signs session cookies, password reset tokens, CSRF tokens and any signed data your app produces. Anyone who knows it can forge a session and log in as any user, which is why it must never be committed to version control or shared between staging and production.
Should I use a different key for each environment?
Yes. Development, staging and production must each have their own key. Sharing one means a leak anywhere compromises everywhere, and it lets a token minted in staging be replayed against production.
Where should the key be stored?
In an environment variable or a secrets manager, never in source control. Add your .env file to .gitignore before the first commit — once a secret is in git history, removing it later does not un-leak it, and the key must be rotated.
Does this work on Windows, Mac, iPhone and Android?
Yes. It runs in any modern browser on Windows, Mac, Linux, iPhone and Android with nothing to install and no account needed. Chrome, Edge, Firefox and Safari are all supported.