Nuxt Session Password & App Secret Generator
Generate a NUXT_SESSION_PASSWORD for nuxt-auth-utils or a NUXT_APP_SECRET for Nuxt 4.6+, right in your browser.
32 random bytes as hex (64 characters), for nuxt-auth-utils. Generated in your browser, never sent to a server.
How to use NUXT_SESSION_PASSWORD
1. Add to your .env file
NUXT_SESSION_PASSWORD=2. Configure in nuxt.config.ts
export default defineNuxtConfig({
runtimeConfig: {
session: {
password: '' // overridden by NUXT_SESSION_PASSWORD
}
}
})32 random bytes as base64, same as openssl rand -base64 32, for Nuxt 4.6+. Generated in your browser, never sent to a server.
How to use NUXT_APP_SECRET
1. Add to your .env file
NUXT_APP_SECRET=2. Use the Nuxt 4.6 useSession from nuxt/server
import { defineEventHandler, useSession } from 'nuxt/server'
export default defineEventHandler(async (event) => {
const session = await useSession<{ visits: number }>(event)
await session.update(data => ({ visits: (data.visits ?? 0) + 1 }))
return { visits: session.data.visits }
}) Runtime config keys starting with app, including runtimeConfig.appSecret, are reserved for Nuxt, so keep your own config under other names. Built-in useSession covers simple sealed-cookie sessions, while nuxt-auth-utils adds OAuth, passkeys and user session helpers.
Which one do I need?
On nuxt-auth-utils v0.5.x (latest is v0.5.31), set NUXT_SESSION_PASSWORD. On Nuxt 4.6+, set NUXT_APP_SECRET in production if a module or server feature uses it, such as useSession from nuxt/server: dev generates one for you, but builds never do. Heads-up: an open nuxt-auth-utils pull request, #546, proposes moving to appSecret for v0.6, which would ignore NUXT_SESSION_PASSWORD and log every user out once (checked October 10, 2026).
Frequently asked questions
Nuxt Beyond ships auth (nuxt-auth-utils), Stripe and Cloudflare deploy wired up, for a one-time price.
Free tool by NuxtBeyond