SESSION_SECRET vs JWT_SECRET?

Use separate values. SESSION_SECRET signs or encrypts server-side session cookies/middleware state. JWT_SECRET (or asymmetric keys) signs JWTs. Reusing one secret across both expands blast radius if either subsystem leaks.

How long should a session secret be?

At least 32 bytes (256 bits) from a CSPRNG. Prefer 64 bytes for high-security or long-lived deployments. This tool defaults to 32 bytes.

What about CSRF secrets?

CSRF_SECRET (or equivalent) backs synchronizer tokens or signed double-submit cookies. Generate a unique high-entropy value per environment — same generator, different env key.

How often should I rotate?

Rotate on suspected compromise and on a planned cadence (e.g. quarterly). Expect existing sessions to invalidate unless you support dual secrets during a grace window.

Tool

Session / CSRF Secret Generator

CSPRNG session and CSRF secrets with .env copy. Client-side only.

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Secret type

Same entropy; .env key becomes SESSION_SECRET.

Length (bytes)

Output format

Generated secret

Click generate to create a cryptographically secure session secret

CLI equivalents (32 bytes · base64url)

openssl rand -base64 32 | tr '+/' '-_' | tr -d '='

Press R to regenerate · keep distinct from JWT_SECRET.

Choose Session or CSRF — this only changes the .env variable name (SESSION_SECRET vs CSRF_SECRET). Entropy is identical.

Pick a byte length (32 / 48 / 64) and output format (base64url default, hex, or base64). Click Generate, then Copy or Copy for .env.

Paste into your deployment environment. Keep SESSION_SECRET distinct from JWT_SECRET. Optional CLI snippets mirror openssl / Node / Python.

const crypto = require('crypto');
const sessionSecret = crypto.randomBytes(32).toString('base64url');
// SESSION_SECRET=<paste>
console.log(sessionSecret);

const crypto = require('crypto');
const sessionSecret = crypto.randomBytes(32).toString('base64url');
// SESSION_SECRET=<paste>
console.log(sessionSecret);

import secrets, base64
raw = secrets.token_bytes(32)
session_secret = base64.urlsafe_b64encode(raw).rstrip(b'=').decode()
print(session_secret)  # SESSION_SECRET=...

import (
    "crypto/rand"
    "encoding/base64"
    "fmt"
)

b := make([]byte, 32)
_, _ = rand.Read(b)
fmt.Println(base64.RawURLEncoding.EncodeToString(b))

Continue learning

ToolsJWT Secret GeneratorAPI Key GeneratorPassphrase Generator

GuidesNode.jsPythonGoJavaRuby

ArticlesJWT vs Session CookiesEnv Vars vs VaultHow to Store JWT Secrets Securely

GlossaryCSRF and JWT CookiesSession CookieCryptographic EntropyJWT Secret Entropy

CompareJWT vs Session CookiesEnvironment Variables vs HashiCorp VaultHex vs Base64 JWT Secrets

How to Use This Tool

Continue learning