--- title: "Secrets for developers – pwgen.de" description: "Keys and passwords in exactly the format your framework expects — generated in your browser, nothing is stored." canonical_url: "https://pwgen.de/en/secrets" meta: "og:description": "Keys and passwords in exactly the format your framework expects — generated in your browser, nothing is stored." "og:image": "https://pwgen.de/_og/s/o_a0bc4f2ea875da11.png" "og:image:height": "630" "og:image:type": image/png "og:image:width": "1200" "og:title": "Secrets for developers – pwgen.de" "twitter:image": "https://pwgen.de/_og/s/o_a0bc4f2ea875da11.png" --- > Index of every page on this site: [llms.txt](https://pwgen.de/llms.txt) # **Secrets for developers** Keys and passwords in exactly the format your framework expects — generated in your browser, nothing is stored. [

**Pattern Generator**

Describe the structure, not just the length: licence keys, coupon codes, test data.](https://pwgen.de/en/pattern-generator) [

**Laravel APP\_KEY Generator**

A valid Laravel APP\_KEY: 32 random bytes, base64-encoded, generated in your browser.](https://pwgen.de/en/laravel-app-key-generator) [

**Django SECRET\_KEY Generator**

50 characters from Django’s own alphabet, identical to get\_random\_secret\_key().](https://pwgen.de/en/django-secret-key-generator) [

**Rails secret\_key\_base Generator**

128 hex characters from 64 random bytes, in exactly the format Rails expects.](https://pwgen.de/en/rails-secret-key-generator) [

**JWT Secret Generator**

Keys for HS256 and HS512, at least as long as the hash output.](https://pwgen.de/en/jwt-secret-generator) [

**Auth.js AUTH\_SECRET Generator**

32 random bytes in base64, equivalent to openssl rand -base64 32.](https://pwgen.de/en/auth-js-secret-generator) [

**Nuxt Session Password Generator**

At least 32 characters for NUXT\_SESSION\_PASSWORD.](https://pwgen.de/en/nuxt-session-password-generator) [

**Database Password Generator**

Only characters that survive a connection string without encoding.](https://pwgen.de/en/database-password-generator) [

**WordPress Salt Generator**

All eight security keys and salts for wp-config.php, generated in your browser.](https://pwgen.de/en/wordpress-salt-generator) Every tool on this page is also available machine-readable: [API](https://pwgen.de/en/api) ## **Frequently asked questions** A random value a framework uses to sign and encrypt sessions, cookies or tokens. It is not a password for humans but a key for the application — which is why it has to come from a cryptographically secure source. In an environment variable, usually through a .env file or your hosting platform's secret management. It does not belong in the repository — not even in an example file that accidentally carries real values. As soon as you suspect it leaked: committed by accident, written to a log, sitting on a compromised server. Plan the rotation deliberately — depending on the framework it invalidates existing sessions or makes encrypted data unreadable. ```json {"@context":"https://schema.org","@graph":[{"@id":"https://pwgen.de/en#website","@type":"WebSite","description":"Kostenloser, datenschutzfreundlicher Passwort-Generator. Generierung direkt im Browser – keine Passwörter werden gespeichert.","inLanguage":"en-US","name":"pwgen.de","url":"https://pwgen.de/en","publisher":{"@id":"https://pwgen.de/#identity"},"translationOfWork":{"@id":"https://pwgen.de/#website"}},{"@id":"https://pwgen.de/en/secrets#webpage","description":"Keys and passwords in exactly the format your framework expects — generated in your browser, nothing is stored.","name":"Secrets for developers","url":"https://pwgen.de/en/secrets","@type":["WebPage","CollectionPage","FAQPage"],"isPartOf":{"@id":"https://pwgen.de/en#website"},"mainEntity":[{"@id":"https://pwgen.de/en/secrets#/schema/question/1"},{"@id":"https://pwgen.de/en/secrets#/schema/question/2"},{"@id":"https://pwgen.de/en/secrets#/schema/question/3"}],"potentialAction":[{"@type":"ReadAction","target":["https://pwgen.de/en/secrets"]}],"primaryImageOfPage":{"@id":"https://pwgen.de/#logo"}},{"@id":"https://pwgen.de/#identity","@type":"Organization","email":"info@htrs.io","legalName":"GbR HTRS i/o","name":"HTRS i/o","telephone":"+49 221 292 513 03","url":"https://pwgen.de","vatID":"DE359532582","address":{"@type":"PostalAddress","streetAddress":"Gotenring 9","addressLocality":"Köln","postalCode":"50679","addressCountry":"DE"},"logo":{"@id":"https://pwgen.de/#logo"},"sameAs":["https://htrs.io"]},{"@id":"https://pwgen.de/en/secrets#/schema/item-list/1","@type":"ItemList","name":"Secrets for developers","itemListElement":[{"@type":"ListItem","name":"Pattern Generator","description":"Describe the structure, not just the length: licence keys, coupon codes, test data.","item":"https://pwgen.de/en/pattern-generator","position":1},{"@type":"ListItem","name":"Laravel APP_KEY Generator","description":"A valid Laravel APP_KEY: 32 random bytes, base64-encoded, generated in your browser.","item":"https://pwgen.de/en/laravel-app-key-generator","position":2},{"@type":"ListItem","name":"Django SECRET_KEY Generator","description":"50 characters from Django’s own alphabet, identical to get_random_secret_key().","item":"https://pwgen.de/en/django-secret-key-generator","position":3},{"@type":"ListItem","name":"Rails secret_key_base Generator","description":"128 hex characters from 64 random bytes, in exactly the format Rails expects.","item":"https://pwgen.de/en/rails-secret-key-generator","position":4},{"@type":"ListItem","name":"JWT Secret Generator","description":"Keys for HS256 and HS512, at least as long as the hash output.","item":"https://pwgen.de/en/jwt-secret-generator","position":5},{"@type":"ListItem","name":"Auth.js AUTH_SECRET Generator","description":"32 random bytes in base64, equivalent to openssl rand -base64 32.","item":"https://pwgen.de/en/auth-js-secret-generator","position":6},{"@type":"ListItem","name":"Nuxt Session Password Generator","description":"At least 32 characters for NUXT_SESSION_PASSWORD.","item":"https://pwgen.de/en/nuxt-session-password-generator","position":7},{"@type":"ListItem","name":"Database Password Generator","description":"Only characters that survive a connection string without encoding.","item":"https://pwgen.de/en/database-password-generator","position":8},{"@type":"ListItem","name":"WordPress Salt Generator","description":"All eight security keys and salts for wp-config.php, generated in your browser.","item":"https://pwgen.de/en/wordpress-salt-generator","position":9}]},{"@id":"https://pwgen.de/en/secrets#/schema/question/1","@type":"Question","inLanguage":"en","name":"What is a framework secret?","acceptedAnswer":{"@type":"Answer","text":"A random value a framework uses to sign and encrypt sessions, cookies or tokens. It is not a password for humans but a key for the application — which is why it has to come from a cryptographically secure source."}},{"@id":"https://pwgen.de/en/secrets#/schema/question/2","@type":"Question","inLanguage":"en","name":"Where does the value belong in my project?","acceptedAnswer":{"@type":"Answer","text":"In an environment variable, usually through a .env file or your hosting platform's secret management. It does not belong in the repository — not even in an example file that accidentally carries real values."}},{"@id":"https://pwgen.de/en/secrets#/schema/question/3","@type":"Question","inLanguage":"en","name":"When do I have to rotate a secret?","acceptedAnswer":{"@type":"Answer","text":"As soon as you suspect it leaked: committed by accident, written to a log, sitting on a compromised server. Plan the rotation deliberately — depending on the framework it invalidates existing sessions or makes encrypted data unreadable."}},{"@id":"https://pwgen.de/#logo","@type":"ImageObject","caption":"HTRS i/o","contentUrl":"https://pwgen.de/apple-touch-icon.png","inLanguage":"en","url":"https://pwgen.de/apple-touch-icon.png"}]} ``` ## Sitemap See the full [sitemap](https://pwgen.de/sitemap.md) for all pages.