diff --git a/.env.example b/.env.example
index 1b561ea0..277c0f80 100644
--- a/.env.example
+++ b/.env.example
@@ -1,60 +1,69 @@
 # ─────────────────────────────────────────────────────────────────────────────
 # urBackend — Environment Variables
-# Copy this file to .env and fill in your values before running docker-compose.
 # ─────────────────────────────────────────────────────────────────────────────
+# Copy this file before editing:
+# Linux/macOS: cp .env.example .env
+# PowerShell: Copy-Item .env.example .env
 
 # ── Server Ports ────────────────────────────────────────────────────────────
 PORT=1234          # For Admin Server (Dashboard)
 USER_PORT=1235     # For User Server (Public API)
 NODE_ENV=development
 
-
-# ── Database & Cache ──────────────────────────────────────────────────────────
+# ── Database & Cache ────────────────────────────────────────────────────────
 # When using docker-compose, these are automatically overridden to point to
 # internal service names (mongo, redis). You do NOT need to change these.
 MONGO_URL=mongodb://mongo:27017/urbackend
 REDIS_URL=redis://redis:6379
 
-# ── Authentication ────────────────────────────────────────────────────────────
+# ── Authentication ──────────────────────────────────────────────────────────
+# Generate random secrets for these values.
+# JWT_SECRET/API_KEY_SALT examples:
+#   openssl rand -base64 32
+#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+#
+# ENCRYPTION_KEY must be 64 hex chars (32 bytes), examples:
+#   openssl rand -hex 32
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 JWT_SECRET=your_super_secret_jwt_key_min_32_chars
-ENCRYPTION_KEY=32_character_long_string_for_byod_creds
+ENCRYPTION_KEY=64_hex_characters_for_aes_256_gcm_key
 API_KEY_SALT=your_random_api_key_salt
 
 # Public API userAuth token config (optional; defaults shown)
 PUBLIC_AUTH_ACCESS_TOKEN_TTL=15m
 PUBLIC_AUTH_REFRESH_TOKEN_TTL_SECONDS=604800
 
-# ── External Storage (Supabase) ───────────────────────────────────────────────
+# ── External Storage (Supabase) ─────────────────────────────────────────────
 # Required for file upload/storage features.
+# Get from: https://app.supabase.com → Project Settings → API
 SUPABASE_URL=https://your-project.supabase.co
 SUPABASE_KEY=your-supabase-anon-key
 
-# ── Email (Resend) ────────────────────────────────────────────────────────────
+# ── Email (Resend) ──────────────────────────────────────────────────────────
 # Required for OTP / email verification flow.
+# Get from: https://resend.com/api-keys
 RESEND_API_KEY=re_your_resend_api_key
 EMAIL_FROM=onboarding@resend.dev
+
+# Get from: https://resend.com/webhooks → Create Endpoint
 RESEND_WEBHOOK_SECRET=whsec_your_resend_webhook_secret
 
-# ── Frontend ──────────────────────────────────────────────────────────────────
+# ── Frontend ────────────────────────────────────────────────────────────────
 FRONTEND_URL=http://localhost:5173
-
 PUBLIC_API_URL=https://api.ub.bitbros.in
 
-# ── Billing (Razorpay) ───────────────────────────────────────────────────────
+# ── Billing (Razorpay) ──────────────────────────────────────────────────────
 # Get from: https://dashboard.razorpay.com → Settings → API Keys
 RAZORPAY_KEY_ID=rzp_test_xxxxxxxxxxxx
 RAZORPAY_KEY_SECRET=xxxxxxxxxxxxxxxxxxxx
 
-# Create from: Razorpay Dashboard → Subscriptions → Plans → Create Plan
+# Create from: https://dashboard.razorpay.com → Subscriptions → Plans → Create Plan
 RAZORPAY_PLAN_ID=plan_xxxxxxxxxxxx
 
-# Set from: Razorpay Dashboard → Settings → Webhooks → Add Endpoint → copy secret
-RAZORPAY_KEY_ID=rzp_testx_xxxx
-RAZORPAY_KEY_SECRET=xxxx
-RAZORPAY_PLAN_ID=xxxx
-RAZORPAY_WEBHOOK_SECRET=xxxx
+# Get from: https://dashboard.razorpay.com → Settings → Webhooks → Add Endpoint
+RAZORPAY_WEBHOOK_SECRET=whsec_xxxxxxxxxxxx
 
-# ── Internal Microservices (AI & Python) ──────────────────────────────────────
+# ── Internal Microservices (AI & Python) ────────────────────────────────────
 # Required for AI Query Builder and Python microservice communication
 PYTHON_SERVICE_URL=http://localhost:8000
 INTERNAL_SECRET=generate_a_random_32_char_secret_here