Free · Private · Client-side

Flask Secret Key Generator

Generate secure SECRET_KEY values for Flask applications. Essential for session security, CSRF protection, and cookie signing.

Generated values never leave this device.
Estimated entropy: 192 bits · 24 random bytes~7,206,860,544 quintillion times the age of the universe to crack
Weak · <50 bitsFairGood · 70+Strong · 100+

In plain terms: a gaming PC guessing a million passwords per second would need 7,206,860,543,787,198 quintillion times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 7,206,860,544 quintillion times the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.

Generated keys

Strong192 bits
Strong192 bits
Strong192 bits
Strong192 bits
Strong192 bits

Usage in Flask

config.py
import os

class Config:
    SECRET_KEY = os.environ.get('SECRET_KEY') or 'your-secret-key'
.env
SECRET_KEY=your-secret-key
app.py
from flask import Flask
from dotenv import load_dotenv

load_dotenv()
app = Flask(__name__)
app.config.from_object('config.Config')

What SECRET_KEY Protects

Session Data

Flask sessions are cryptographically signed using SECRET_KEY to prevent tampering.

CSRF Tokens

Flask-WTF uses SECRET_KEY to generate and validate CSRF protection tokens.

Cookies

Secure cookies are signed to ensure they haven't been modified by clients.

Flask-Login

Remember-me tokens and session authentication rely on SECRET_KEY.

Bulk Generation

keys

Generate in Terminal

Generate Flask secret keys locally using Python:

Python secrets (recommended)

$python3 -c "import secrets; print(secrets.token_hex(24))"

Python os.urandom

$python3 -c "import os; print(os.urandom(24).hex())"

OpenSSL

$openssl rand -hex 24

Security Best Practices

  • Never commit SECRET_KEY to version control
  • Use environment variables in production
  • Use at least 24 bytes (192 bits) for security
  • Changing the key invalidates all existing sessions

API key & secret handling best practices →