golive.ly

Generate cryptographically strong .env secrets

Hex, base64 or URL-safe, in any quantity. Backed by the Web Crypto API, ready to paste straight into your .env.

Free tool · Updated August 2026 · No account required

View on GitHub
Generate secrets
Web Crypto · 100% local
.env

Choose your options and generate a fresh set.

What makes a good .env secret key?

  • Long enough to resist brute force, at least 128 bits
  • Random from a cryptographic source, never a pattern
  • Unique per service, so one leak does not compromise everything

The generator emits fresh values from the browser's cryptographic random source every time. No reuse, no pattern, no shared keys across apps.

Hex vs base64 vs URL-safe for API keys

  • Hex is the safe default, with no characters that break shell quoting or URLs
  • Base64 is shorter for the same entropy
  • URL-safe swaps +/ for -_, so keys fit cleanly into query strings

If keys need to live in Git, pair them with the vault encryptor so they stay encrypted at rest.

Related Developer Tools

Validate .env

Check syntax and duplicates

Diff .env files

Spot missing keys between two files

Encrypt .env

Turn a .env into a vault

Envy CLI

The local-first .env manager

Frequently Asked Questions

Common questions about generating .env secrets

Yes. Every secret comes from crypto.getRandomValues, the browser's hardware-backed CSPRNG. No Math.random and no weak PRNG.