Flask SECRET_KEY Generator

What the Flask docs tell you to run

Straight from the Flask configuration docs: python -c 'import secrets; print(secrets.token_hex())'. With no argument, token_hex() uses CPython's DEFAULT_ENTROPY of 32 bytes and prints them as 64 lowercase hex characters — that is exactly what the generator above produces, without needing Python installed. Flask signs your session cookie with this key (via itsdangerous), so a weak or shared value lets anyone forge a session; a full-entropy random one closes that off.

How long should a Flask secret key be?

Long enough to be unguessable, which 32 random bytes comfortably is — and note that Flask's own docs are internally inconsistent here, so don't read too much into a specific number. The SECRET_KEY section shows 32 bytes (64 hex chars); the from_prefixed_env example elsewhere uses 16. The signing is HMAC-SHA-1 based, whose block gives a 160-bit effective ceiling, so anything from 16 bytes up is fine and 32 is the safe, doc-matching default. What Flask does not do is validate the format — a too-short or malformed key fails silently as a weaker signature, never as an error, which is exactly why getting it right at generation time matters.

Rotating it without logging everyone out

Since Flask 3.1 you can set SECRET_KEY_FALLBACKS to a list of old keys: Flask signs new sessions with SECRET_KEY and still accepts cookies signed with a fallback, so you can rotate without invalidating every live session at once. Keep the key in an environment variable, out of the repository, and use a distinct one per environment. This is the same 32-byte hex shape as a raw hex secret and a close cousin of Django's SECRET_KEY and Rails' secret_key_base — the differences are the length and the encoding, not the idea.