# Env generator: keep the secret on the server.

Generate random application secrets and a .env template for Next.js, Supabase and Stripe. Clearly separate public variables from server credentials — free, no sign-up.

Page: https://saascode.ai/tools/env-generator

## How to use

1. Optionally fill in your public site URL, Supabase URL, publishable or legacy anon key, and Stripe publishable key. Never enter secret provider keys here.
2. Choose Generate env to create fresh 32-byte secrets with browser crypto.getRandomValues.
3. Copy or download the template locally. Replace server placeholders using your provider dashboards, keep it out of Git and configure each deployment environment.

## Scope

Provider keys are placeholders. Generated secrets are not Supabase JWT signing keys, Stripe API keys or webhook signing keys.

## References

- [Next.js environment variables](https://nextjs.org/docs/app/guides/environment-variables)
- [Stripe API keys](https://docs.stripe.com/keys)

## Build your SaaS

[Get SaaSCode Base](https://saascode.ai/free)

## Related tools

- [Supabase JWT decoder](https://saascode.ai/tools/jwt-decoder)
- [PostgreSQL SQL formatter](https://saascode.ai/tools/sql-formatter)
- [Supabase pricing calculator](https://saascode.ai/tools/supabase-pricing-calculator)
- [All free tools](https://saascode.ai/tools)

## FAQ

### Is this free, and do I need an account?

It is free, no sign-up. Processing happens in your browser. Tool inputs and results are not sent to a processing API or saved by this tool. Usage analytics record only the tool name and action.

### Which values can reach the browser?

Next.js inlines NEXT_PUBLIC_ values into client bundles at build time. Only public site URLs, Supabase publishable or legacy anon keys and Stripe publishable keys belong there. A public Supabase key still requires correct RLS policies.

### Which keys must stay on the server?

Supabase secret or service_role keys, Stripe secret and webhook signing keys, application secrets and cron secrets must never use NEXT_PUBLIC_. Keep them in your deployment secret store or an untracked local env file.

### Does this create working Supabase or Stripe API keys?

No. Provider credentials must come from those providers. The tool generates random application and cron secrets and leaves clearly marked placeholders for provider-issued credentials.

### How strong are the generated secrets?

Each generated application or cron secret uses 32 independent random bytes from crypto.getRandomValues, encoded as 64 hexadecimal characters. Hex encoding does not add entropy. Generate a different secret for each environment.

### Is this the exact env file for every SaaSCode Base installation?

No. It is a focused Next.js + Supabase + Stripe template. Your Base version and payment integration determine the variables you actually need; use its setup documentation as the source of truth.