Free OJS Tool
OJS App Key Generator for OJS 3.5.x
Generate a secure application key for Open Journal Systems 3.5.x config.inc.php in one click.
The key is generated server-side using PHP's CSPRNG and is not stored by CyberDairy.
OJS App Key Generator
Generate a cryptographically secure base64:… key for OJS 3.5.x
config.inc.php.
Your Secure OJS App Key
config.inc.php to a public repository.
Ready-to-copy config.inc.php line
[general] ; An application-specific key that is required for the app to run ; Internally this is used for any encryption app_key =
random_bytes().
OJS 3.5.x
New in OJS 3.5
OJS 3.5 introduced app_key as a required configuration parameter in
the [general] section of config.inc.php.
Without it, OJS 3.5.x will not run.
Related Services
Upgrading to OJS 3.5.x?
Get a professional review before changing your production journal.
Get OJS Upgrade HelpWhat is the OJS app_key?
In OJS 3.5.x, app_key is an application-specific secret stored in the
[general] section of config.inc.php. OJS uses the application key
internally for encryption and decryption, including encrypted cookies when cookie encryption is
enabled. Each OJS installation should use its own securely generated key.
The OJS configuration template describes the parameter as: "An application-specific key that is required for the app to run. Internally this is used for any encryption (specifically cookie encryption if enabled)."
View official OJS config template →Where do I add the app_key in OJS?
Open your OJS config.inc.php file and locate the [general] section.
Add the generated value to the app_key setting:
[general] app_key = base64:YOUR_GENERATED_KEY installed = On
config.inc.php before making upgrade or production configuration changes.
Upgrading to OJS 3.5.x?
OJS upgrades involve more than generating an app key
PHP compatibility, database upgrades, plugins, themes, custom code, scheduled jobs, queues, email configuration, file permissions, backups, and new configuration parameters should all be checked before a production upgrade. Test on staging before changing a live journal.
Why does OJS 3.5 require an application key?
OJS 3.5 introduced an application-specific key for encryption/decryption. This gives the application
a dedicated cryptographic secret rather than relying on predictable or shared values. It is
required in config.inc.php for OJS 3.5.x to start.
Can I use the same app_key on multiple OJS websites?
No. Generate a unique key for each independent OJS installation. Do not copy a production key between unrelated journal installations.
Can I change my OJS app_key later?
Avoid casually changing an active production application key. Data or cookies encrypted with the previous key may no longer be decryptable with a different key. If a key must be rotated because of a suspected compromise, plan the change carefully and test it first on a staging copy before changing production.
Is the key stored by CyberDairy?
No. The generator creates the key only for the current request using PHP's built-in
random_bytes(). CyberDairy does not save generated keys to any database, application
log, analytics platform, or user account.
How to generate OJS app_key using OpenSSL or PHP CLI
If you have shell access to your server, you can generate the key from the command line. These are shown for reference only — this website never executes shell commands to generate keys.
Linux / SSH (OpenSSL)
$ echo "base64:$(openssl rand -base64 32)"
PHP CLI
$ php -r "echo 'base64:' . base64_encode(random_bytes(32)) . PHP_EOL;"
Need Help With Your OJS Journal?
CyberDairy provides technical services for publishers, universities, societies, research organizations, and journal administrators using Open Journal Systems.
OJS Upgrade & Version Migration
Upgrade older OJS installations to a supported OJS release with backup planning, compatibility checks, database upgrade assistance, plugin review, configuration review, and post-upgrade testing.
Get OJS Upgrade HelpOJS Security & Configuration Audit
Review OJS configuration, file permissions, exposed files, HTTPS settings, server environment, administrator security, plugins, backups, and common deployment risks.
Request Security AuditOJS Development & Customization
Custom OJS themes, plugins, workflow changes, integrations, UI improvements, bug fixing, and publisher-specific development.
Explore OJS DevelopmentOJS Migration & Server Transfer
Move OJS journals between servers or hosting environments while preserving journal data, submissions, uploaded files, URLs, and configurations.
Get Migration AssistanceOJS Maintenance & Technical Support
Ongoing troubleshooting, updates, backups, email issues, cron and scheduled-task configuration, performance review, and technical maintenance.
Request OJS SupportCheck Your OJS Version
Not sure which OJS release your journal is running? Use the free OJS Version Checker to detect your version and compare it with the current LTS baseline.
Check OJS VersionFrequently Asked Questions
app_key is an application-specific secret stored in the [general] section of config.inc.php. OJS uses it internally for encryption and decryption, including encrypted cookies when cookie encryption is enabled.
Use this tool to generate a cryptographically secure random key in the base64:... format expected by OJS 3.5.x. Click Generate OJS App Key and then copy the result into your config.inc.php.
Place it in the [general] section of your OJS config.inc.php file: app_key = base64:YOUR_GENERATED_KEY
It is an application secret and must be protected similarly to other sensitive server configuration values. Keep it private, do not commit config.inc.php to a public repository.
No. Independent OJS installations should each use a uniquely generated key.
No. The tool generates the key only for your current request and does not save it to any database, application log, analytics platform, or user account.
Yes. An administrator with shell access can run: echo "base64:$(openssl rand -base64 32)" or with PHP: php -r "echo 'base64:' . base64_encode(random_bytes(32)) . PHP_EOL;"
Avoid rotating it casually. Data or cookies encrypted with the previous key may no longer be decryptable with a different key. If rotation is required due to a suspected compromise, plan and test the change carefully before applying it to production.
Planning an OJS 3.5 Upgrade?
Generate your app key here, then let CyberDairy help you review the rest of your OJS upgrade, server compatibility, plugins, database, configuration, security, and deployment.