secrets.h Generator
Generate an example secrets.h for Arduino/ESP32 and the .gitignore line that protects it.
Common fields
Custom fields
Generated secrets.h
// Generated with the secrets.h Generator — https://nexinon.dev/secrets-header-generator
// Fill in the real values below, save this file as "secrets.h" inside your
// sketch folder, and never commit this file to version control — see the
// .gitignore line this tool also generates, right below.
// Wi-Fi
#define WIFI_SSID "REPLACE_WITH_YOUR_WIFI_SSID"
#define WIFI_PASSWORD "REPLACE_WITH_YOUR_WIFI_PASSWORD"
.gitignore line
secrets.h
Why keep secrets out of your code
Every ESP32/Arduino sketch that connects to a Wi-Fi network, an API, or an MQTT broker needs sensitive data: network name and password, an API key, broker credentials. Writing those values straight into the .ino file is the fastest way to get started — and the most common way secrets leak: when the project is pushed to GitHub (to share it, ask for help, build a portfolio), the secret goes along with it, published for anyone to see. secrets.h fixes this by separating what is code (the .ino, safe to publish) from what is a secret (secrets.h, which never leaves your machine).
How to use the generated secrets.h
1) Download or copy the content below and save it as "secrets.h", in the same folder as your main sketch (.ino). 2) At the top of your sketch, add #include "secrets.h". 3) Replace each placeholder (the quoted text, like REPLACE_WITH_YOUR_WIFI_SSID) with the real value — only locally, never inside Nexinon. 4) Use the macros in your code like any #define, e.g. WiFi.begin(WIFI_SSID, WIFI_PASSWORD);. 5) Add the .gitignore line below to your project before the first commit that touches secrets.h.
What if secrets.h was already committed before?
Adding the line to .gitignore only affects what happens from now on — it doesn't remove a file that was already committed, nor erase a secret that's already in the repository's history. If that already happened, run "git rm --cached secrets.h" (to stop tracking the file while keeping your local copy) and make a new commit. The step that actually matters, though, is rotating any real secret that was already exposed — it stays in the Git history even after that (and in any clone/fork made before), so it must be treated as compromised, never just "hidden" again.
Does this replace a full .gitignore?
No — this tool only solves the secrets.h part: the example file and the exact line that excludes it from Git. The rest of your project's .gitignore (build/, .pio/, IDE files, etc.) is the job of Nexinon's .gitignore Generator, with templates per language/framework/IDE — see the button above, right below the .gitignore line. secrets.h is a project convention, not an artifact of the Arduino/PlatformIO ecosystem itself, so no per-language .gitignore generator would know to add this line on its own.
Frequently asked questions
Both work, but #define is the convention used by Arduino's own official examples (arduino_secrets.h, published in the official arduino/ArduinoCloudProviderExamples and arduino-libraries/ArduinoIoTCloud repositories) — confirmed against those sources before settling on the format, not assumed from memory. If your project already uses const char* for another reason, the swap is mechanical: const char* WIFI_SSID = "..."; instead of #define WIFI_SSID "...".
No — they're placeholders on purpose, never a working value. The point is the opposite of an empty string (""): a visible, obvious placeholder like this fails in a way that's easy to notice (a network named "REPLACE_WITH_YOUR_WIFI_SSID" obviously doesn't exist), instead of silently compiling with an empty string and leaving you puzzled about why Wi-Fi won't connect.
Yes — the "Custom fields" section accepts any constant name your project needs (a service token, a channel ID, whatever it is). You only provide the field's NAME, never the real value; the generated value is always the same generic placeholder, for you to fill in later, locally.
Not by itself — see "What if secrets.h was already committed before?", above. Adding the .gitignore line prevents a future leak; it doesn't undo one that already happened. Any secret that was already exposed needs to be rotated, not just hidden again.
They're the two halves of the same problem. This tool is prevention: it keeps a secret from leaking through source code published on GitHub. The Firmware Secret Scanner (not published in the catalog yet) is detection: it reads an already-compiled .bin/.hex looking for a secret left inside it, in plain text, even when the source code was never published. Compiling and distributing only the binary protects the source code, but not a hardcoded secret, which stays readable inside the binary; the two tools together cover both ends.
See "Does this replace a full .gitignore?", above — this tool's core is secrets.h; the .gitignore line is just its direct complement. Use the "Generate the rest of your .gitignore" button to cover the rest of the project.
Nexinon Principles
Privacy
Your data never leaves your browser.No account needed
Use it now, no account or password.Free
No usage limits, no paid plan.Trustworthy content
Full explanation behind every tool, not just the result.