Auth.js AUTH_SECRET Generator
32 random bytes in base64, equivalent to openssl rand -base64 32.
Very strong0 bitsGenerated in your browser
Local alternative
openssl rand -base64 32Prefer generating secrets on the machine that uses them? This command produces an equivalent value.
Official documentationAuth.js, formerly NextAuth.js, signs and encrypts session tokens and JWTs with this value. It is mandatory in production and the application refuses to start without it. Changing the value signs out every logged-in user.
Frequently asked questions
Into the AUTH_SECRET environment variable. Auth.js uses it to encrypt the session cookie and sign internal tokens. In production the value is mandatory — without it, Auth.js refuses to start.
Every existing session becomes invalid and all signed-in users have to authenticate again. For a planned rotation, pick a low-traffic window.