docs: add secure key generation guide for session and encryption keys

README.md

@@ -44,14 +44,19 @@ git clone https://git.techniverse.net/scriptos/keywarden.git
 cd keywarden
 ```
 
-Create a `.env` file:
+Create a `.env` file and generate two separate cryptographically secure keys:
 
-```env
-KEYWARDEN_SESSION_KEY=your-random-session-key-at-least-32-characters
-KEYWARDEN_ENCRYPTION_KEY=your-random-encryption-key-at-least-32-chars
+```bash
+# Generate keys (run twice, once per key):
+openssl rand -base64 48
 ```
 
-> **Important:** Change both keys to unique random strings. The encryption key protects all stored SSH private keys — if lost, they cannot be recovered.
+```env
+KEYWARDEN_SESSION_KEY=<first generated string>
+KEYWARDEN_ENCRYPTION_KEY=<second generated string>
+```
+
+> **Important:** Change both keys to unique random strings. The encryption key protects all stored SSH private keys — if lost, they cannot be recovered. See the [Quick Start Guide](docs/quickstart.md) for more options to generate secure keys.
 
 ### 2. Start
 

docs/quickstart.md

@@ -17,10 +17,25 @@ mkdir keywarden && cd keywarden
 
 Create a `.env` file with at minimum these settings:
 
+Generate two separate, cryptographically secure random strings (minimum 32 characters each):
+
+```bash
+# Linux / macOS
+openssl rand -base64 48
+
+# Alternative without OpenSSL
+head -c 48 /dev/urandom | base64
+
+# Windows (PowerShell)
+[Convert]::ToBase64String((1..48 | ForEach-Object { Get-Random -Max 256 }) -as [byte[]])
+```
+
+Each command produces a 64-character Base64 string. Run it **twice** — once for each key — and paste the values below:
+
 ```env
 # REQUIRED: Change these for security!
-KEYWARDEN_SESSION_KEY=your-random-session-key-at-least-32-characters
-KEYWARDEN_ENCRYPTION_KEY=your-random-encryption-key-at-least-32-chars
+KEYWARDEN_SESSION_KEY=<first generated string>
+KEYWARDEN_ENCRYPTION_KEY=<second generated string>
 
 # Optional: Owner credentials (defaults: admin / auto-generated password)
 KEYWARDEN_OWNER_USER=admin