Rails SECRET_KEY_BASE Generator

bin/rails secret, without Ruby

The whole Rails command is two lines — require "securerandom"; puts SecureRandom.hex(64) — so it emits 64 bytes as 128 lowercase hex characters. The generator above produces the identical shape in your browser, which is the point if you are in a Docker build, a CI runner or a Windows box where bin/rails secret is inconvenient. The terminal equivalent is openssl rand -hex 64; both give you the same class of secret from the same kind of CSPRNG.

Fixing "Missing secret_key_base for 'production' environment"

This is the error that sends most people here, and half the advice you will find for it is out of date. Modern Rails looks for the value in two places, in order: the SECRET_KEY_BASE environment variable, then credentials.secret_key_base in your encrypted credentials. The old config/secrets.yml that Stack Overflow answers from 2015–2018 tell you to edit is no longer read — Rails removed that support. Set SECRET_KEY_BASE to the value above in your production environment and the error clears. For asset precompilation in a build step where you have no real secret yet, set SECRET_KEY_BASE_DUMMY=1 and Rails supplies a throwaway value for that run.

Where Rails stores it, and what it protects

In development and test, Rails writes a generated value to tmp/local_secret.txt the first time it needs one, so you rarely see it. In production it is yours to manage: keep it in the environment or in credentials, out of the repository, distinct per environment. It signs and encrypts cookies, sessions and signed/encrypted message verifiers — rotating it invalidates all of those, so treat a change as a migration, not a config tweak. It is the same 64-byte hex shape as a raw hex secret, twice the length of Flask's key.