Key length
- Input
- get_random_secret_key()
- Expected output
- 50 caracteres
Same length as the generator.
Carregando ferramenta… / Loading tool…
generate django secret key
Open Django SECRET_KEY in the generator and use the drawn values. The .env line already comes in single quotes, the care that most examples forget.
Same length as the generator.
26 letters, 10 digits and 14 symbols.
About 5.64 bits per character.
Single quotes protect $ and #.
32 x log2(62), less than the Django 50.
Use at least 32 random bytes (256 bits): RFC 7518, section 3.2, says the HMAC key must be the size of the hash output or larger, that is 256 bits for HS256, 384 for HS384 and 512 for HS512. A short phrase or dictionary word as the secret can be cracked by offline brute force from a single token.
You can. Django only asks for a unique, unpredictable value. With 62 symbols, use at least 43 characters to pass 256 bits. The Alphanumeric format of the generator shows the entropy of each size.
Sessions, cookie messages, password reset tokens and signed values made with the old key stop being valid. To avoid the cut, use SECRET_KEY_FALLBACKS during the transition.
Most likely there was an unquoted #, treated as the start of a comment, or a $ read as a variable. Wrap the value in single quotes, as the generator does.
Random bytes in hexadecimal: 2 characters per byte. 32 bytes give 64 characters and 256 bits.
openssl rand -hex 32python3 -c "import secrets; print(secrets.token_hex(32))"Pick the variables and copy the block. Each generation draws new values; values with $, # or spaces come out quoted.
Turn on at least one variable.
For production, prefer generating locally with the terminal command. Any secret typed or copied from a web page should be treated as exposed if you do not trust the device or the browser extensions. Nothing here is sent or stored.