Skip to content

Instantly share code, notes, and snippets.

@ndarville
Created August 24, 2012 17:01
Show Gist options
  • Save ndarville/3452907 to your computer and use it in GitHub Desktop.
Save ndarville/3452907 to your computer and use it in GitHub Desktop.
Generating a properly secure SECRET_KEY in Django
"""
Two things are wrong with Django's default `SECRET_KEY` system:
1. It is not random but pseudo-random
2. It saves and displays the SECRET_KEY in `settings.py`
This snippet
1. uses `SystemRandom()` instead to generate a random key
2. saves a local `secret.txt`
The result is a random and safely hidden `SECRET_KEY`.
"""
try:
SECRET_KEY
except NameError:
SECRET_FILE = os.path.join(PROJECT_PATH, 'secret.txt')
try:
SECRET_KEY = open(SECRET_FILE).read().strip()
except IOError:
try:
import random
SECRET_KEY = ''.join([random.SystemRandom().choice('abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*(-_=+)') for i in range(50)])
secret = file(SECRET_FILE, 'w')
secret.write(SECRET_KEY)
secret.close()
except IOError:
Exception('Please create a %s file with random characters \
to generate your secret key!' % SECRET_FILE)
@tjps
Copy link

tjps commented Jan 15, 2018

Simplest and most accurate way is to just use the function in Django directly:

python manage.py shell -c 'from django.core.management import utils; print(utils.get_random_secret_key())'

@hseritt
Copy link

hseritt commented Mar 2, 2018

Thanks tjps ... using that in my app.

@dnintzel
Copy link

dnintzel commented Mar 30, 2018

Is secret-key-gen.py intended to be a one-time generator or would you possibly call at boot time to generate new key? I don't use heroku/(ephemeral fs), but maybe that usage would solve that issue too?

...or generating with any method including tjps' suggestion?

[update] One bad side affect to new secret key is credentials are lost and forces re-authentication (if used).

@MavropaliasG
Copy link

Hi everyone, I'm very interesting to try that in our django project Epitome.

@ndarville, @SEJeff and everyone thank you for writing this code.

The reason I need this is because I am developing a script to automate installation in linux distributions. The problem is that I haven't found a way to automate the creation of a unique secret key.

I know I'm asking for a lot, but if someone could someone create a pull request to our settings.py file with a script that will automatically create a secret key regardless of being in linux or windows and with the user not having to do anything further, I will be extremely grateful. I have tried implementing the code snippets here but with no success.

Please send me a message if you would like to discuss further, I will be happy to hear from you.

@andytwoods
Copy link

in windows python manage.py shell -c "from django.core.management import utils; print(utils.get_random_secret_key())" (nb double not single quotes)

@SerhatTeker
Copy link

Simplest and most accurate way is to just use the function in Django directly:

python manage.py shell -c 'from django.core.management import utils; print(utils.get_random_secret_key())'

That's great. Thanks a lot for this info @tjps.

@ndarville
Copy link
Author

This is one of those gists I made a million years ago for myself and then forgot all about that seems to have taken on its own SEO life subsequently. You definitely shouldn't use the original advice at this point. :)

@theoden-dd
Copy link

If using Python 3.6+ also consider e.g. secrets.token_urlsafe .

@almereyda
Copy link

Another form of the one line command is:

$ python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"

from https://stackoverflow.com/a/68085559/1959568.

Please note that your local interpreter might only be available through a versioned binary name, like python3, and/or its absolute path, e.g. /usr/lib/python3.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment