Better Auth Secret

Secure TypeScript Authentication Keys

Fast & Secure Generation

Generate Secure Better Auth Secrets

Create cryptographically secure secrets for your Better Auth TypeScript applications. Used for encryption, signing, and hashing in your authentication system.

Standard (32 bytes)
Official Better Auth recommendation (openssl rand -base64 32)
Enhanced (48 bytes)
Higher security for sensitive data
Maximum (64 bytes)
Maximum security for enterprise use
64 characters
Generating secret...

Security Note

Store this secret securely in your environment variables. Never commit it to version control or expose it in client-side code.

Official Better Auth Command

Better Auth officially recommends using OpenSSL to generate secrets:

✓ Official Better Auth Recommendation:
openssl rand -base64 32
→ Generates Base64 format (~44 characters)
Alternative Methods:
npx @better-auth/cli secret
Better Auth CLI tool
This Web Tool
Browser-based generation (hexadecimal format)

Security Note

All methods generate equally secure 256-bit secrets. Choose based on your development environment and preferences.

Understanding Better Auth Secrets

Learn how Better Auth secrets secure your TypeScript applications through encryption, signing, and hashing operations.

Encryption

Encrypts sensitive data including session tokens, user credentials, and other confidential information to protect against unauthorized access.

Signing

Digitally signs tokens and authentication data to ensure authenticity and integrity, preventing tampering and unauthorized modifications.

Hashing

Hashes passwords and sensitive information before storage, adding an essential layer of security to your authentication system.

Implementation Guide

1. Environment Configuration

Add your generated secret to your environment variables:

# .env.local
BETTER_AUTH_SECRET=your_generated_secret_here

2. Better Auth Configuration

Configure Better Auth with your secret:

import { betterAuth } from "better-auth";

export const auth = betterAuth({
  secret: process.env.BETTER_AUTH_SECRET,
  // ... other configuration options
});

3. Production Deployment

Ensure your secret is properly configured in your production environment:

  • Set the environment variable in your hosting platform
  • Use your platform's secret management system when available
  • Never hardcode secrets in your application code
  • Consider secret rotation for enhanced security

Security Best Practices

✓ Do:

  • • Store secrets in environment variables
  • • Use strong, randomly generated secrets
  • • Rotate secrets periodically
  • • Use different secrets for different environments
  • • Keep secrets confidential and secure

✗ Don't:

  • • Commit secrets to version control
  • • Expose secrets in client-side code
  • • Use weak or predictable secrets
  • • Share secrets via unsecure channels
  • • Hardcode secrets in your application
REST API

Better Auth Secret API

A single GET request returns a ready-to-use secret string. Designed for AI agents, CI/CD pipelines, shell scripts, and any HTTP client.

Endpoint

https://better-auth-secret.com/api

AI Agent Usage

A plain GET request returns only the secret — no JSON to parse, no extra fields. Perfect for tool calls in LLM agents.

curl "https://better-auth-secret.com/api"

Response: a1b2c3d4e5f6789012345678901234567890abcdef…

Methods

  • GET — query string params
  • POST — JSON body

Parameters

  • lengthBytes 16–128, default 32
  • formathex | base64, default hex
  • outputtext | json, default text

Basic — Plain Text

GETtext/plain

Returns a raw secret string — ideal for AI agents, shell scripts, and automation.

Request

curl "https://better-auth-secret.com/api"

Response

a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456

JSON Output

GETapplication/json

Add ?output=json for a structured response with metadata.

Request

curl "https://better-auth-secret.com/api?output=json"

Response

{
  "secret": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456",
  "length": 32,
  "format": "hex",
  "timestamp": "2024-01-15T10:30:00.000Z"
}

Custom Length

GETtext/plain

Specify byte length (16–128). Default is 32 bytes.

Request

curl "https://better-auth-secret.com/api?length=64"

Response

a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12345678

Base64 Format

GETtext/plain

OpenSSL-compatible Base64 output (same as openssl rand -base64 32).

Request

curl "https://better-auth-secret.com/api?format=base64"

Response

YWJjZGVmZ2hpams1Njc4OTBhYmNkZWZnaGlqa2xtbm9w

POST with JSON Body

POSTapplication/json

Send options as a JSON payload for programmatic control.

Request

curl -X POST "https://better-auth-secret.com/api" \
  -H "Content-Type: application/json" \
  -d '{"length": 48, "format": "hex", "output": "json"}'

Response

{
  "secret": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456789012345678901234567890abcd",
  "length": 48,
  "format": "hex",
  "timestamp": "2024-01-15T10:30:00.000Z"
}

Performance

  • • Sub-100ms response times globally
  • • Cryptographically secure (Web Crypto API)
  • • No rate limiting for reasonable usage
  • • Edge-deployed worldwide

AI & Automation

  • • Plain text default — zero parsing needed
  • • CORS enabled for web clients
  • • No authentication required
  • • Compatible with all HTTP clients & LLM tools

Fast Generation

Generate secure secrets instantly using Web Crypto API

Cryptographically Secure

Uses browser's secure random number generation

TypeScript Ready

Perfect for Better Auth TypeScript applications

Developer Friendly

Simple interface with implementation examples

Frequently Asked Questions

What's the difference between this tool and the official OpenSSL command?

Better Auth officially recommends using openssl rand -base64 32to generate secrets. Key differences:

OpenSSL command:

Generates 32 random bytes, then converts to Base64 format (~44 characters)

Our tool:

Generates 32 random bytes, then converts to hexadecimal format (64 characters)

Both methods have the same entropy (256 bits) and identical security, just different encoding formats. Better Auth accepts secrets in any format.

What is Better Auth?

Better Auth is a universal authentication and authorization framework for TypeScript applications. It provides secure, flexible authentication solutions with built-in security features and easy integration.

How secure are the generated secrets?

Our generator uses the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG). This provides the same level of security as Better Auth's official CLI tool and OpenSSL commands.

Does Better Auth support different secret lengths?

Better Auth primarily uses 32-byte (256-bit) secrets as recommended in their documentation. While the framework can technically handle longer secrets, the standard 32-byte length provides excellent security for most applications. The enhanced and maximum options are provided for users who prefer additional entropy, though they exceed typical requirements.

Which secret length should I choose?

For most applications, the standard 32-byte (256-bit) secret provides excellent security. Choose longer secrets for applications handling highly sensitive data or enterprise environments.

Can I use this for production applications?

Yes! The secrets generated here are suitable for production use. However, ensure you follow security best practices: store secrets in environment variables, never commit them to version control, and consider periodic rotation.

Should I use this tool or the OpenSSL command?

Both methods generate equally secure secrets. The official openssl rand -base64 32command is perfect for command-line workflows, while this web tool offers convenience, visual feedback, and educational content.

OpenSSL Command

Perfect for CLI workflows and automation

Web Tool

Convenient with visual feedback and guides

About Better Auth Secrets

Better Auth secrets are hexadecimal strings used for cryptographic operations in your authentication system. They secure session tokens, sign JWT tokens, encrypt sensitive data, and hash passwords. Our generator creates secrets that are compatible with the Better Auth framework and follow industry security standards.