Auth Secret Generator
Generate a cryptographically secure random key for AUTH_SECRET, BETTER_AUTH_SECRET, NEXTAUTH_SECRET, JWT signing or any other environment variable — right in your browser.
Generated locally in your browser with the Web Crypto API — nothing is ever sent to a server.
What are these secrets used for?
Authentication libraries use a server-side secret to sign and encrypt session tokens. Better Auth reads BETTER_AUTH_SECRET, Auth.js (NextAuth) reads AUTH_SECRET, and JWT libraries need a signing key — all of them expect a high-entropy random value that only your server knows.
A weak or reused secret lets attackers forge session tokens and impersonate any user. Generate a dedicated 32-byte secret per project and per environment, and keep it out of version control.
How to use the generated secret
Add the key to your .env file:
# .env
BETTER_AUTH_SECRET=your-generated-secret # Better Auth
AUTH_SECRET=your-generated-secret # Auth.js / NextAuth v5
JWT_SECRET=your-generated-secret # generic JWT signingThe Base64 URL-safe format matches what `npx auth secret` and `openssl rand -base64 32` produce, and is accepted by Better Auth, Auth.js/NextAuth, and every JWT library.
Frequently Asked Questions
How long should an AUTH_SECRET be?
At least 32 bytes (256 bits) of randomness. This matches the output of `npx auth secret` and the recommendations of Better Auth and Auth.js. This generator defaults to 32 bytes.
What's the difference between AUTH_SECRET and BETTER_AUTH_SECRET?
They serve the same purpose for different libraries: AUTH_SECRET is read by Auth.js (NextAuth v5), while BETTER_AUTH_SECRET is read by Better Auth. Both expect a high-entropy random string like the ones this tool generates.
Is browser-side generation cryptographically secure?
Yes. The tool uses crypto.getRandomValues from the Web Crypto API — the same CSPRNG quality as openssl. The secret never leaves your device.
What happens if I rotate the secret?
All existing sessions and tokens signed with the old secret become invalid, so users will need to sign in again. Rotate immediately if you suspect a leak.
This free tool is built and maintained by NEXTY.DEV — the Next.js SaaS boilerplate that ships with Better Auth, Stripe payments and AI already wired up.