Generating a properly secure SECRET_KEY in Django

secret-key-gen.py

"""
Two things are wrong with Django's default `SECRET_KEY` system:

1. It is not random but pseudo-random
2. It saves and displays the SECRET_KEY in `settings.py`

This snippet
1. uses `SystemRandom()` instead to generate a random key
2. saves a local `secret.txt`

The result is a random and safely hidden `SECRET_KEY`.
"""
try:
    SECRET_KEY
except NameError:
    SECRET_FILE = os.path.join(PROJECT_PATH, 'secret.txt')
    try:
        SECRET_KEY = open(SECRET_FILE).read().strip()
    except IOError:
        try:
            import random
            SECRET_KEY = ''.join([random.SystemRandom().choice('abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*(-_=+)') for i in range(50)])
            secret = file(SECRET_FILE, 'w')
            secret.write(SECRET_KEY)
            secret.close()
        except IOError:
            Exception('Please create a %s file with random characters \
            to generate your secret key!' % SECRET_FILE)

This is one of those gists I made a million years ago for myself and then forgot all about that seems to have taken on its own SEO life subsequently. You definitely shouldn't use the original advice at this point. :)

If using Python 3.6+ also consider e.g. secrets.token_urlsafe .

Another form of the one line command is:

$ python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"

from https://stackoverflow.com/a/68085559/1959568.

Please note that your local interpreter might only be available through a versioned binary name, like python3, and/or its absolute path, e.g. /usr/lib/python3.