Flask Secret Key Generator
Flask Secret Key Generator — generated on your device, never transmitted.
Paste into your .env:
This produces 64 hex characters — 32 random bytes — which is exactly what the Flask documentation recommends generating with secrets.token_hex(32). It comes from your browser’s cryptographic random source and is never sent anywhere.
Frequently Asked Questions
Is it safe to generate a secret key on a website?
It is here, because nothing is transmitted. The key is produced by crypto.getRandomValues inside your own browser — the same cryptographic generator your operating system uses — and never touches the network. You can disconnect from the internet and this page still works, which is the simplest way to prove it.
What breaks if my Flask SECRET_KEY leaks?
Session cookies in Flask are signed, not encrypted, with this key. Anyone holding it can both read the session contents and forge a valid session for any user — so treat a leak as a full authentication bypass and rotate it immediately.
Should I use a different key for each environment?
Yes. Development, staging and production must each have their own key. Sharing one means a leak anywhere compromises everywhere, and it lets a token minted in staging be replayed against production.
Where should the key be stored?
In an environment variable or a secrets manager, never in source control. Add your .env file to .gitignore before the first commit — once a secret is in git history, removing it later does not un-leak it, and the key must be rotated.
Does this work on Windows, Mac, iPhone and Android?
Yes. It runs in any modern browser on Windows, Mac, Linux, iPhone and Android with nothing to install and no account needed. Chrome, Edge, Firefox and Safari are all supported.