Switch secret generate output from hex to base64 encoding

alexellis · alexellis · commit bb85f62465ba · 2026-03-24T10:50:03.000Z
This output is now more comparable to the output from openssl
which we used to recommend previously.

Signed-off-by: Alex Ellis (OpenFaaS Ltd) &lt;alexellis2@gmail.com&gt;
diff --git a/commands/secret_generate.go b/commands/secret_generate.go
@@ -2,7 +2,7 @@ package commands
 
 import (
 	"crypto/rand"
-	"encoding/hex"
+	"encoding/base64"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -19,20 +19,20 @@ var secretGenerateCmd = &cobra.Command{
 	Use:   "generate",
 	Short: "Generate a random secret value",
 	Long:  "Generate a cryptographically random secret suitable for HMAC payload signing or other shared secrets",
-	Example: `  # Print a 32-byte hex-encoded secret to stdout
+	Example: `  # Print a 32-byte base64-encoded secret to stdout
   faas-cli secret generate
 
   # Write to a file
   faas-cli secret generate -o payload.txt
 
-  # Custom length (in bytes, output is hex-encoded)
+  # Custom length in bytes
   faas-cli secret generate --length 64
 `,
 	RunE: runSecretGenerate,
 }
 
 func init() {
-	secretGenerateCmd.Flags().IntVar(&generateLength, "length", 32, "Number of random bytes (output is hex-encoded, so 32 bytes = 64 hex chars)")
+	secretGenerateCmd.Flags().IntVar(&generateLength, "length", 32, "Number of random bytes")
 	secretGenerateCmd.Flags().StringVarP(&generateOutput, "output", "o", "", "Write to file instead of stdout")
 
 	secretCmd.AddCommand(secretGenerateCmd)
@@ -44,7 +44,7 @@ func runSecretGenerate(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("generating random bytes: %w", err)
 	}
 
-	secret := hex.EncodeToString(buf)
+	secret := base64.StdEncoding.EncodeToString(buf)
 
 	if generateOutput != "" {
 		dir := filepath.Dir(generateOutput)
@@ -57,7 +57,7 @@ func runSecretGenerate(cmd *cobra.Command, args []string) error {
 		if err := os.WriteFile(generateOutput, []byte(secret), 0600); err != nil {
 			return fmt.Errorf("writing secret: %w", err)
 		}
-		fmt.Printf("Wrote %d-byte secret (hex) to %s\n", generateLength, generateOutput)
+		fmt.Printf("Wrote %d-byte secret to %s\n", generateLength, generateOutput)
 	} else {
 		fmt.Println(secret)
 	}
diff --git a/commands/secret_generate_test.go b/commands/secret_generate_test.go
@@ -32,9 +32,9 @@ func TestSecretGenerateToFile(t *testing.T) {
 		t.Fatalf("ReadFile: %v", err)
 	}
 
-	// 32 bytes hex-encoded = 64 chars
-	if len(data) != 64 {
-		t.Fatalf("want 64 hex chars, got %d", len(data))
+	// 32 bytes base64-encoded = 44 chars
+	if len(data) != 44 {
+		t.Fatalf("want 44 base64 chars, got %d", len(data))
 	}
 
 	info, _ := os.Stat(outPath)

Original file line number	Diff line number	Diff line change
`@@ -32,9 +32,9 @@ func TestSecretGenerateToFile(t *testing.T) {`
`32`	`32`	`t.Fatalf("ReadFile: %v", err)`
`33`	`33`	`}`
`34`	`34`
`35`		`- // 32 bytes hex-encoded = 64 chars`
`36`		`- if len(data) != 64 {`
`37`		`- t.Fatalf("want 64 hex chars, got %d", len(data))`
	`35`	`+ // 32 bytes base64-encoded = 44 chars`
	`36`	`+ if len(data) != 44 {`
	`37`	`+ t.Fatalf("want 44 base64 chars, got %d", len(data))`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`info, _ := os.Stat(outPath)`