What secret_key_base protects
Rails derives the keys for its signed and encrypted cookies and message verifiers from secret_key_base. If it leaks, an attacker can forge sessions. If it changes, every user is logged out.
bin/rails secret produces 64 random bytes written as 128 hex characters. This generator makes the same thing in your browser, which helps when you are filling in a hosting dashboard or a CI secret before you have the app checked out.
Where to put it
- In config/credentials.yml.enc, using bin/rails credentials:edit.
- Or in the SECRET_KEY_BASE environment variable, which Rails reads in production.
- Use a different value for every environment.
Frequently asked questions
What happens if I change secret_key_base?
Existing sessions, signed cookies and encrypted cookies become invalid, so every user is logged out. Rails can rotate cookies to make the switch smoother.
Does it have to be hex?
The official command outputs hex, and that is what most guides expect. Hex is also safe in every shell and config format.