django secret key usage and generation

 https://docs.djangoproject.com/en/5.0/ref/settings/#std-setting-SECRET_KEY

SECRET_KEY¶

Default: '' (Empty string)

A secret key for a particular Django installation. This is used to provide cryptographic signing, and should be set to a unique, unpredictable value.

django-admin startproject automatically adds a randomly-generated SECRET_KEY to each new project.

Uses of the key shouldn’t assume that it’s text or bytes. Every use should go through force_str() or force_bytes() to convert it to the desired type.

Django will refuse to start if SECRET_KEY is not set.

Warning

Keep this value secret.

Running Django with a known SECRET_KEY defeats many of Django’s security protections, and can lead to privilege escalation and remote code execution vulnerabilities.

The secret key is used for:

• All sessions if you are using any other session backend than django.contrib.sessions.backends.cache, or are using the default get_session_auth_hash().
• All messages if you are using CookieStorage or FallbackStorage.
• All PasswordResetView tokens.
• Any usage of cryptographic signing, unless a different key is provided.

When a secret key is no longer set as SECRET_KEY or contained within SECRET_KEY_FALLBACKS all of the above will be invalidated. When rotating your secret key, you should move the old key to SECRET_KEY_FALLBACKS temporarily. Secret keys are not used for passwords of users and key rotation will not affect them.

# NOTE: if you generate a new project everytime, django will automatically generate this key for you.

if you copied projects, or wish to generate another secret key:

https://stackoverflow.com/questions/41298963/is-there-a-function-for-generating-settings-secret-key-in-django

python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'