JWT Secret Generator

Size the secret to the algorithm

HMAC-based JWT algorithms are only as strong as their secret. RFC 7518 requires a key at least as long as the hash output: 256 bits for HS256, 384 for HS384 and 512 for HS512. This generator picks the matching size automatically.

Weak secrets are a real problem. A token signed with a short or dictionary secret can be cracked offline from a single captured token, after which an attacker can forge any token they like.

Using the secret

• Load it from an environment variable such as JWT_SECRET. Never hard-code it.
• Use a different secret per environment, so a staging token never validates in production.
• Plan for rotation: accept a current and a previous secret during a changeover.
• If several services verify tokens but only one issues them, consider an asymmetric algorithm such as EdDSA or ES256. The Ed25519 and ECDSA generators make those keys.

Frequently asked questions