Fernet Key Generator

Common mistakes

⚠Generating the key with a non-CSPRNG source instead of a proper random generator

⚠Losing the key without a backup — Fernet has no recovery mechanism

⚠Hardcoding the key in source code instead of loading it from the environment

⚠Reusing one Fernet key across unrelated services or environments

What is Fernet?

Fernet is Python's cryptography library's opinionated symmetric encryption recipe — it combines AES-128 in CBC mode with an HMAC-SHA256 authentication tag and a timestamp, so tokens are both encrypted and tamper-evident. The key itself is 32 random bytes, urlsafe-base64 encoded.

How to add it to your project

Copy the generated key into your .env:
```
FERNET_KEY=<paste here>
```

Load and use it with cryptography.fernet:

from cryptography.fernet import Fernet
import os

f = Fernet(os.environ["FERNET_KEY"].encode())
token = f.encrypt(b"secret data")
plaintext = f.decrypt(token)

Never hardcode the key in source and never commit .env — rotate it via a secrets manager if it's ever exposed.

Verifying the format matches Fernet.generate_key()

>>> from cryptography.fernet import Fernet
>>> Fernet.generate_key()
b'aFOfD-hsobOnGocK_rALPLJxoo397Lo1_pweh-0lQKc='

44 characters, urlsafe-base64 alphabet, single trailing = — identical shape to what this tool generates client-side.

Frequently asked questions

What is a Fernet key?

Fernet is a symmetric encryption recipe from Python's cryptography library that bundles AES-128-CBC encryption with HMAC-SHA256 authentication into one simple API. The key is 32 random bytes, urlsafe-base64 encoded — exactly what Fernet.generate_key() returns.

Why does the key end in an equals sign?

That's standard base64 padding. 32 bytes doesn't divide evenly into 3-byte base64 groups, so the encoding adds one '=' padding character at the end. Fernet.generate_key() always produces this same 44-character, single-'='-padded format — this tool matches it exactly.

Can I use this key for Django's Fernet-based field encryption?

Yes — packages like django-fernet-fields and django-cryptography accept a standard Fernet key. Set it as an environment variable and load it the same way you'd load FERNET_KEY here.

What happens if I lose the key?

Any data encrypted with it becomes permanently unrecoverable — Fernet has no key recovery mechanism. Back up the key in a secrets manager before encrypting anything you need to keep.

What it does

Privacy

When to use this tool