JWT Secret Generator

Generate a JWT signing secret

JSON Web Tokens signed with an HMAC algorithm such as HS256 rely on a shared secret key, and the security of every token depends entirely on that secret being long and random. This generator produces a strong random secret of a size appropriate to your algorithm, formatted as base64, hexadecimal or URL-safe base64. A thirty-two-byte secret suits HS256, forty-eight bytes HS384, and sixty-four bytes HS512, matching the output size of each hash.

Using a secret at least as long as the hash output ensures the full security of the algorithm is realised.

Protecting your tokens

If an attacker learns or guesses your JWT secret, they can forge valid tokens and impersonate any user, so a weak or hard-coded secret is a critical vulnerability. A random secret of sufficient length cannot be guessed, and keeping it out of source control and configuration files visible to others is essential. Rotate the secret periodically and immediately if you suspect it has leaked.

The secret is generated locally using the browser secure random generator where available, so it is never transmitted. Store it securely in an environment variable or secrets manager. All generation happens locally in your browser.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.