Better Auth Secret Generator

BETTER_AUTH_SECRET is the server-side secret Better Auth uses to sign session tokens, encrypt sensitive cookies and hash verification data. Every Better Auth project needs one — in production the library refuses to start with a missing or default value.

The secret must be a high-entropy random string that only your server knows. A weak or shared secret lets an attacker forge session cookies and sign in as any user. Generate a dedicated 32-byte secret per project and per environment, and never commit it to version control.

1. Add the generated key to your .env file as BETTER_AUTH_SECRET:

# .env
BETTER_AUTH_SECRET=your-generated-secret
BETTER_AUTH_URL=http://localhost:3000

2. Better Auth picks it up from the environment automatically — or pass it explicitly via the secret option:

// lib/auth.ts
import { betterAuth } from "better-auth";

export const auth = betterAuth({
  // Better Auth reads BETTER_AUTH_SECRET from the environment
  // automatically — set the option only to override it.
  secret: process.env.BETTER_AUTH_SECRET,
  // ...database, plugins, social providers
});

See the full Better Auth setup guide in the NEXTY.DEV docs

Prefer a terminal? The official Better Auth CLI and openssl produce the same class of 32-byte secret:

# Better Auth CLI
npx @better-auth/cli@latest secret

# or with openssl
openssl rand -base64 32

Need keys for AUTH_SECRET, NEXTAUTH_SECRET or JWT signing too? Use the universal auth secret generator.