RandomKeygen

Free · Private · Client-side

Django SECRET_KEY Generator

Generate secure SECRET_KEY values for Django projects. Uses the same character set and length as Django's default key generation.

Generated values never leave this device.
50 characters, Django's default charset
Estimated entropy: 282 bits · 50-character pool~8,921,661,224,700,181,000,000,000,000,000,000,000 quintillion times the age of the universe to crack
Weak · <50 bitsFairGood · 70+Strong · 100+

In plain terms: a gaming PC guessing a million passwords per second would need 8,921,661,224,700,181,000,000,000,000,000,000,000,000,000 quintillion times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 8,921,661,224,700,181,000,000,000,000,000,000,000 quintillion times the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.

Generated secrets

Strong282 bits
Strong282 bits
Strong282 bits
Strong282 bits

How to Use in Django

Basic settings.py

myproject/settings.py
# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = 'your-secret-key-here'

# Other settings...
DEBUG = False
ALLOWED_HOSTS = ['yourdomain.com']

Environment Variables (Recommended)

.env
DJANGO_SECRET_KEY=your-secret-key-here
DJANGO_DEBUG=False
DJANGO_ALLOWED_HOSTS=yourdomain.com,www.yourdomain.com
myproject/settings.py
import os
from django.core.exceptions import ImproperlyConfigured

def get_env_variable(var_name):
    """Get the environment variable or return exception."""
    try:
        return os.environ[var_name]
    except KeyError:
        error_msg = f"Set the {var_name} environment variable"
        raise ImproperlyConfigured(error_msg)

SECRET_KEY = get_env_variable('DJANGO_SECRET_KEY')
DEBUG = get_env_variable('DJANGO_DEBUG') == 'True'
ALLOWED_HOSTS = get_env_variable('DJANGO_ALLOWED_HOSTS').split(',')

Docker Compose

docker-compose.yml
version: '3.8'
services:
  web:
    build: .
    environment:
      - DJANGO_SECRET_KEY=your-secret-key-here
      - DJANGO_DEBUG=False
    ports:
      - "8000:8000"

Using python-decouple

requirements.txt
python-decouple==3.8
myproject/settings.py
from decouple import config

SECRET_KEY = config('SECRET_KEY')
DEBUG = config('DEBUG', default=False, cast=bool)

Django Version Compatibility

Our SECRET_KEY format is compatible with all Django versions:

Django 4.x+ (Current LTS)

  • Full compatibility with new security features
  • Works with new CSRF and session implementations
  • Compatible with async views and middleware

Django 3.x (LTS)

  • Fully compatible with all 3.x features
  • Same character set as django-admin startproject
  • Works with all cryptographic signing

Django 2.x

  • Compatible with legacy 2.x installations
  • Supports all session and CSRF functionality
  • Works with older Python versions (3.6+)

Django 1.x

  • Works with Django 1.8+ (older LTS versions)
  • Compatible with legacy project structures
  • Note: Consider upgrading to supported versions
Migration Tip

When upgrading Django versions, you typically don't need to regenerate your SECRET_KEY. The same key will work across versions, maintaining session continuity for users.

Bulk Generation

secrets

Generate in Terminal

For production, generate the key on your server:

Django's built-in generator

$python3 -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"

Python secrets module

$python3 -c "import secrets; import string; chars = string.ascii_lowercase + string.digits + '!@#$%^&*(-_=+)'; print(''.join(secrets.choice(chars) for _ in range(50)))"

OpenSSL

$openssl rand -base64 50 | tr -dc 'a-zA-Z0-9!@#$%^&*(-_=+)' | head -c 50

Never commit secrets

Store your SECRET_KEY in environment variables or a secrets manager. Never commit it to version control. Consider using packages likepython-decouple or django-environ.

API key & secret handling best practices →

What SECRET_KEY is used for

  • Cryptographic signing (sessions, cookies, password reset tokens)
  • CSRF protection tokens
  • Unique salts for password hashing
  • Any use of Django's signing framework

Changing SECRET_KEY will invalidate all existing sessions and signed data.