Flask Secret Key Generator
Generate a random SECRET_KEY for a Flask project. Produces a 64-character hex string equivalent to Python's secrets.token_hex(32), ready to use in your app config.
Add this to your Flask app config:
app.config['SECRET_KEY'] = ''Recommended Settings
Pro Tips
- •This generates 32 random bytes encoded as 64 hexadecimal characters, matching the output format of Python's secrets.token_hex(32) - a commonly recommended way to generate a Flask SECRET_KEY
- •Flask's SECRET_KEY is used to cryptographically sign session cookies and other security-sensitive data
- •Store your SECRET_KEY as an environment variable rather than hard-coding it directly in your application's source code
- •If your SECRET_KEY changes, all existing user sessions signed with the old key become invalid, logging users out
Most Popular
Most Flask developers generate a 32-byte (64 hex character) key using Python's secrets module or an equivalent tool like this one
When to Use This Tool
Generate a fresh SECRET_KEY when starting a new Flask project.
Generate a key used to cryptographically sign Flask session cookies.
Generate a key to store in your .env file or deployment environment's secret manager.
Generate a replacement key if your existing SECRET_KEY may have been exposed.
How It Works
Generate 32 cryptographically secure random bytes using the Web Crypto API
Encode those bytes as a 64-character hexadecimal string, matching the common Python secrets.token_hex(32) convention
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Web Crypto API (crypto.getRandomValues) for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
Is this equivalent to Python's secrets.token_hex(32)?
Yes, in format and security properties. Both generate 32 cryptographically secure random bytes and encode them as a 64-character hex string. This tool uses the browser's Web Crypto API instead of Python's secrets module, but both are cryptographically secure sources of randomness.
Where should I store my SECRET_KEY?
Store it as an environment variable and load it into your Flask config at runtime, rather than hard-coding it directly in a file that might get committed to version control.
What happens if I change my SECRET_KEY?
Changing the SECRET_KEY invalidates all existing signed session cookies, effectively logging out every currently logged-in user. Plan key rotations accordingly.
Is my generated key sent to a server?
No. The key is generated entirely locally in your browser using JavaScript. It's never transmitted anywhere, including to this website's own servers.
Can I use a shorter key?
This tool always generates a 32-byte (64 character) key, which is a strong, commonly recommended length. Shorter keys are technically possible but provide less security margin.