SELFHOST.COMPUTER

Secret Generator

Pick the names your stack needs and get a block of random values to paste into .env or a compose file. The values are made in your browser with crypto.getRandomValues. Nothing is sent, logged or stored, and they're gone when you close the tab.

Secrets to generate:

Your secrets 


  
Save these in a password manager before you close the page. They aren't kept anywhere.






  
Use it

  
cd ~/stack
nano .env              # paste the block
chmod 600 .env         # only your user can read it
echo '.env' >> .gitignore

  
Compose reads .env from the project folder automatically and fills in ${POSTGRES_PASSWORD} in compose.yaml:

  
services:
  db:
    image: postgres:17-alpine
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

  
If the same password is used in two services (the database and the app that connects to it), reference the same variable in both so they can't drift apart.


  
Why these characters

  
    
    
  • The default sets leave out $, #, quotes, backslash, spaces and the URL delimiters @ : / ?. Compose treats $ as a variable, .env parsers treat # and quotes specially, and a password with @ or / breaks a postgres://user:pass@host/db connection string unless you percent-encode it.
    • 
    
  • Length matters more than symbols. A 32-character random string from 62 symbols is roughly 190 bits, far beyond anything that can be guessed.
    • 
    
  • Values are drawn with rejection sampling, so every character is equally likely (no modulo bias).
    • 
    
  • Hex is there for apps that want a hex key. If an app wants a specific length or encoding (some want exactly 32 or 64 hex characters), set the length to match.
    • 
  


  
Things to know

  
    
    
  • Database passwords only apply on first start. The Postgres and MySQL images read POSTGRES_PASSWORD when they create the data directory. Changing the variable later doesn't change the stored password; change it inside the database or recreate the volume.
    • 
    
  • Some apps want a hash, not a plain password. Vaultwarden's ADMIN_TOKEN, for example, should be an Argon2 hash made with the app's own tooling. Check the app's docs for what each variable expects.
    • 
    
  • Don't commit the file. Keep the real .env out of git and out of your backups' public copies, or encrypt them. The restic setup encrypts backups with its own password.
    • 
    
  • Prefer your password manager for human logins. These are for services talking to each other.
    • 
  

  
Need the compose file itself? The Compose + Caddy generator writes one and marks every CHANGE_ME that needs a value from here. Securing a fresh server comes first: the first 15 minutes.