diff --git a/scripts/generate-des-key.sh b/scripts/generate-des-key.sh
new file mode 100644
index 0000000..15a4706
--- /dev/null
+++ b/scripts/generate-des-key.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Generates a random 24-character key suitable for RC_DES_KEY in .env.
+set -euo pipefail
+
+LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24
+echo