JWT Secret Generator
Secure random signing keys for JWTs
Characters
Strength 256 bits
43 characters
How it works
A random secret is generated entirely in your browser using
Strength
The slider sets the key strength in bits of entropy. The number of characters is chosen so the generated key carries at least that much randomness.
crypto.getRandomValues(), a cryptographically secure random source. Nothing is ever sent to a server.Strength
The slider sets the key strength in bits of entropy. The number of characters is chosen so the generated key carries at least that much randomness.
What is a JWT secret?
A JWT (JSON Web Token) signed with an HMAC algorithm (HS256, HS384, HS512) uses a single shared secret to both create and verify the token's signature. Anyone who knows this secret can forge valid tokens, so it must be long, random, and kept private.
For HS256 the secret should be at least 256 bits (the default here). Longer secrets add a safety margin. Store the generated value in an environment variable or secrets manager, never commit it to source control.
For HS256 the secret should be at least 256 bits (the default here). Longer secrets add a safety margin. Store the generated value in an environment variable or secrets manager, never commit it to source control.