JWT Secret Generator

A secret worth signing with

An HMAC-signed JWT is only as strong as its secret. Anyone who guesses it can mint tokens your server will trust, and short or human-chosen secrets are exactly what offline cracking tools try first. This generator draws the key from your browser's cryptographic random number generator, at the length the algorithm calls for.

How long the secret should be

• HS256 needs at least 32 bytes (256 bits). Anything shorter is weaker than the hash it is paired with, and many libraries refuse it.
• HS384 needs at least 48 bytes (384 bits).
• HS512 needs at least 64 bytes (512 bits).
• Longer is fine. A key longer than the hash's block size is hashed down first, so there is nothing to gain past 64 bytes for HS256 or 128 bytes for HS512.

Using the secret

• Keep it out of your code. Put it in an environment variable or a secrets manager; "Copy as .env" gives you the line ready to paste.
• Mind the encoding. Some libraries take the secret as text, others expect raw bytes in Base64. If you decode it to bytes, choose Base64 or Base64URL here; if your library uses the string as it is, hex is the safest choice.
• Rotating it signs everyone out. Every token signed with the old secret stops verifying, so plan a rotation rather than doing it in a hurry.
• Test before you deploy. "Test in the JWT Decoder" opens the decoder with a sample token signed with this secret, so you can see what a valid signature looks like.

Frequently asked questions

How do I generate a JWT secret key?

Pick the algorithm your server uses, and a secret of the right length is generated straight away. Choose the encoding your library expects, then copy the secret or the ready-made .env line. Press Regenerate for a new one.

How long should a JWT secret be for HS256?

At least 32 bytes, which is 256 bits: 64 hex characters or 43 Base64URL characters. A shorter secret is weaker than the SHA-256 hash it is used with.

Is it safe to generate a secret in the browser?

Yes. The key comes from crypto.getRandomValues, the same cryptographic generator browsers use for TLS, and it is created on your device. It is not sent to a server, logged or stored.

Should I use hex or Base64 for my JWT secret?

Both hold the same random bytes. Hex is the safest if your library treats the secret as plain text; Base64 or Base64URL is right if your library decodes the secret into raw bytes first, as many configuration options ask you to.

Can I use a password as a JWT secret?

It is not a good idea. Passwords are short and predictable compared with 32 random bytes, and anyone with one of your tokens can try to guess the secret offline, as fast as their hardware allows.