Generate secrets for your .env

This one, yes. Every value is made in your browser with crypto.getRandomValues, the same random source your operating system uses for keys. Nothing is sent to a server, stored or logged, and the page keeps working with your Wi-Fi turned off. Close the tab and the values are gone.

A random 32-byte value in base64, which is what the “Auth secret” card makes. It is the same as running npx auth secret or openssl rand -base64 32. Auth.js v5 reads AUTH_SECRET, and NextAuth v4 reads NEXTAUTH_SECRET: rename the line in “Your .env lines” to match.

For HS256, at least 32 bytes (256 bits) of real randomness. This tool makes 64 bytes by default, which also covers HS512. Never use a word or a sentence: short secrets can be guessed offline from any token someone has seen.

A shared secret your server uses to check that a webhook really came from the sender, by recomputing an HMAC signature. The whsec_ prefix is the style Stripe, Svix and Clerk use. Change the prefix or clear it to match the service you are setting up.

Both are unique IDs, not secrets. v4 is fully random. v7 starts with the time it was made, so new rows sort in order and database indexes stay fast, which makes it the better choice for primary keys. Don’t use either as a password or a token.

Better not: whatever you paste into a chat goes to the AI provider. Put the values in .env.local yourself, then use “Copy prompt for your AI agent”, which names your variables without their values and asks the agent to wire them up and keep them out of git.

Make a new one here, replace the old value everywhere it is used, and turn the old one off. Deleting the file is not enough, because the old value stays in your git history. Then add .env files to your .gitignore with the .gitignore generator.