diff --git a/deploy/production.env.example b/deploy/production.env.example
index 1959c17..fc76361 100644
--- a/deploy/production.env.example
+++ b/deploy/production.env.example
@@ -2,8 +2,9 @@
 
 DOMAIN=musicshare.binarygnome.com
 
-# Generate each with: openssl rand -base64 32
+# openssl rand -hex 32   (hex: the password goes inside a URL, so no / + = characters)
 POSTGRES_PASSWORD=
+# openssl rand -base64 32   (reuse the old key when importing a database, or saved connections break)
 TOKEN_ENCRYPTION_KEY=
 
 # Optional: exact "Open in Spotify" links (catalog search only; no user sign-in)