Is this JWT secret generator safe to use?

Yes. All generation happens entirely in your browser using the Web Crypto API (crypto.getRandomValues). No data is sent to any server, and nothing is logged.

What encoding should I choose for my JWT secret?

Base64url is the most portable and compatible with most JWT libraries. Hex is human-readable and easy to inspect. ASCII/UTF-8 secrets work but may have lower entropy per character due to the reduced character set.

Can I use the generated secret in Node.js, Python, or PHP?

Absolutely. Generated secrets work with jsonwebtoken (Node.js), PyJWT (Python), firebase/php-jwt (PHP), and virtually every JWT library.

JWT Secret Generator – Free Secure Key Generator Online

Q: How long should a JWT secret be?

For HS256 use at least 256 bits (32 bytes), for HS384 use 384 bits (48 bytes), and for HS512 use at least 512 bits (64 bytes). A longer secret significantly increases security.

Everything you need for secure JWTs

Built for developers who care about security and speed — no accounts, no tracking, no nonsense.

🔐

Web Crypto API

Uses crypto.getRandomValues() — the browser's CSPRNG — for true cryptographic randomness. Not Math.random().

⚡

Algorithm-Aware

Automatically enforces minimum key lengths per NIST guidelines: 256-bit for HS256, 384-bit for HS384, 512-bit for HS512.

📦

Multiple Encodings

Output in Base64url, Base64, Hexadecimal, or ASCII Printable — whichever your JWT library expects.

📊

Live Entropy Meter

Instantly visualize the strength of your generated key with a colour-coded entropy score and bit-strength indicator.

🔁

Batch Generation

Generate up to 50 unique secrets in one click — perfect for multi-tenant applications or rotating key pools.

💾

Copy / Download / Clear

One-click copy to clipboard, download as a .txt file, or instantly wipe output. Your workflow, your way.

🛡️

Zero Server Contact

All generation happens in your browser tab. No API calls, no server logs, no telemetry. Fully air-gap safe.

📱

Mobile Friendly

Fully responsive design adapts to any screen size. Generate keys on your phone or tablet just as easily.

♿

Accessible

ARIA-labeled controls, keyboard navigation, and screen reader support. Built to WCAG 2.1 AA standards.

How it works

From settings to secure key in three steps — takes less than five seconds.

Choose your algorithm & encoding

Select the HMAC algorithm your application uses (HS256, HS384, or HS512). Pick an output encoding compatible with your JWT library. The tool enforces NIST-recommended minimum key sizes automatically.

Click Generate

The browser calls crypto.getRandomValues() to fill a typed array with cryptographically secure random bytes. No seeds, no patterns — pure entropy. The result is immediately encoded in your chosen format.

crypto.getRandomValues(new Uint8Array(64)) → encode → your secret ✓

Copy, download, and store safely

Copy the key to your clipboard, download it as a .txt file, or paste directly into your .env file, secrets manager, or CI/CD pipeline. Done!

JWT_SECRET=<your-generated-key>

Why Your JWT Secret Key Is the Most Critical Security Decision You'll Make

JSON Web Tokens are the backbone of modern authentication. From REST APIs to GraphQL services, from mobile backends to serverless functions — JWTs are everywhere. And at the heart of every signed JWT sits a single artefact that determines whether your entire auth system holds or crumbles: the secret key.

This guide explains what a JWT secret is, why weak secrets are exploited in minutes, how to generate a cryptographically strong one, and how to manage it across your application lifecycle.

What Is a JWT Secret Key, Exactly?

A JWT consists of three Base64url-encoded parts separated by dots: a header, a payload, and a signature. For HMAC-based JWTs (HS256, HS384, HS512), the signature is computed as:

HMAC-SHA256(base64url(header) + "." + base64url(payload), secret)

The secret acts as the signing key. When your server receives a JWT, it re-computes the signature using the same secret. If the signatures match, the token is authentic and untampered. If they don't, the token is rejected. An attacker who knows your secret can forge any token they wish — including ones claiming admin privileges.

The Real Cost of a Weak JWT Secret

Widely publicised attacks have shown that many production APIs use secrets like secret, password, 1234567890, or even an empty string. These can be cracked offline in milliseconds using GPU-accelerated dictionary tools. Once forged, an attacker's token looks identical to a legitimate one — your server has no way to tell the difference.

Account takeover: Forge a token as any user ID.
Privilege escalation: Change role: "user" to role: "admin".
Session permanence: Create tokens that never expire.
Data exfiltration: Access resources behind JWT-protected endpoints at will.

Algorithm Choice and Minimum Key Lengths

Algorithm	HMAC Hash	Min Key Length	Recommended
HS256	SHA-256	256 bits (32 B)	256 – 512 bits
HS384	SHA-384	384 bits (48 B)	384 – 768 bits
HS512	SHA-512	512 bits (64 B)	512 – 1024 bits

NIST SP 800-107 specifies that the key length should be at least equal to the output length of the underlying hash function. Using a 128-bit secret with HS256 technically "works" but violates the spec and dramatically reduces security.

Using Your Generated Secret: Framework Examples

Node.js (jsonwebtoken):

const jwt = require('jsonwebtoken'); const token = jwt.sign({ userId: 42 }, process.env.JWT_SECRET, { algorithm: 'HS512', expiresIn: '15m' });

Python (PyJWT):

import jwt, os token = jwt.encode({'user_id': 42}, os.environ['JWT_SECRET'], algorithm='HS512')

PHP (firebase/php-jwt):

use Firebase\JWT\JWT; $token = JWT::encode(['user_id' => 42], $_ENV['JWT_SECRET'], 'HS512');

Storing Your Secret Safely

Use .env files locally — never commit them to Git (.gitignore is mandatory).
In production, use a secrets manager: AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, or GCP Secret Manager.
Inject secrets as environment variables in CI/CD pipelines (GitHub Actions secrets, GitLab CI variables).
Rotate your secret periodically and immediately on suspected compromise. Implement a short-lived token strategy to minimise disruption.
Never log tokens or secrets — sanitise your logging pipeline.

RS256 vs HS256: When to Use Which?

HMAC secrets (HS256/384/512) use a single shared secret for both signing and verification. This is fast and simple, but means every service that verifies tokens must also have the secret — creating multiple attack surfaces. If you have many microservices verifying tokens, consider RS256 (RSA-based asymmetric signing): only the auth server has the private key, and all others use the public key to verify.

For monolithic apps or when the same service signs and verifies tokens, HS512 with a strong secret is an excellent, efficient choice.

Frequently Asked Questions

What is a JWT Secret Key?

A JWT (JSON Web Token) secret key is a cryptographic string used to sign and verify tokens using HMAC algorithms (HS256, HS384, HS512). It proves that a token was issued by a trusted authority and hasn't been tampered with. Anyone who knows the secret can forge tokens, so it must be long, random, and kept private.

How long should a JWT secret be?

Per NIST SP 800-107: at least 256 bits (32 bytes) for HS256, 384 bits (48 bytes) for HS384, and 512 bits (64 bytes) for HS512. We recommend going higher — 512 bits for HS256 and 1024 bits for HS512 — for additional headroom against future attacks.

Is this JWT generator safe to use?

Yes. All generation happens 100% in your browser using the Web Crypto API's crypto.getRandomValues() function — the same CSPRNG used by password managers and browsers. No data is sent to any server. No logs. No storage. You can disconnect from the internet and it will still work.

What encoding should I use for my JWT secret?

Base64url is the most widely compatible — it's URL-safe, compact, and supported by virtually every JWT library. Hex is more verbose but human-readable, useful for debugging. ASCII is fine but has lower entropy per character since it restricts the byte range. Avoid encoding formats not natively supported by your framework.

Can I use this secret in Node.js, Python, PHP, Go, or Java?

Yes. The generated secret is a plain string that works with any JWT library: jsonwebtoken (Node.js), PyJWT (Python), firebase/php-jwt (PHP), golang-jwt/jwt (Go), io.jsonwebtoken (Java), and more. Just paste it as your signing key.

How often should I rotate my JWT secret?

Rotate immediately on any suspected compromise, server breach, or employee offboarding. For general best practice, rotate every 90–180 days. Implement versioned secrets with a brief overlap period so existing valid tokens don't immediately break — then phase out the old secret after your token expiry window.

What's the difference between HS256, HS384, and HS512?

All three use HMAC (Hash-based Message Authentication Code) but with different SHA hash functions. HS256 uses SHA-256 (256-bit output), HS384 uses SHA-384, and HS512 uses SHA-512. Higher numbers mean longer signatures and higher security margins, at a negligible performance cost on modern hardware. HS512 is recommended for new projects.

JWT Secret Key Generator