developer utility
JWT Secret Generator
Generate a cryptographically secure random secret for signing JWTs. Choose a key size that meets the JWA minimum for HS256, HS384, or HS512 and export it as Base64, Base64URL, or hex. Everything runs locally with crypto.getRandomValues — nothing is sent to a server.
What is JWT Secret Generator?
Generate a cryptographically secure random secret for signing JWTs. Choose a key size that meets the JWA minimum for HS256, HS384, or HS512 and export it as Base64, Base64URL, or hex. Everything runs locally with crypto.getRandomValues — nothing is sent to a server. Everything runs 100% client-side in your browser — no data is ever uploaded to a server, nothing is logged or stored, and the tool is completely free with no signup required.
Quick Answers
- How many bits should a JWT secret be?
- The JWA standard requires an HS256 key of at least 256 bits (32 bytes), HS384 of at least 384 bits (48 bytes), and HS512 of at least 512 bits (64 bytes). Generating at or above those sizes satisfies the specification regardless of the library or identity provider you use.
- Where should I store the generated secret?
- In an environment variable on your server, never in client-side code or a public repository. For production, prefer a secrets manager or the environment-variable mechanism of your hosting platform, and rotate the value when anyone with access leaves the team.
- Is a random string generated in the browser secure?
- Yes — the tool uses the browser's crypto.getRandomValues, which draws from a cryptographically secure source of randomness, not Math.random(). A 256-bit value from it has enough entropy that it cannot be guessed or brute-forced in practice.
All decoding happens entirely in your browser. No data is ever sent to a server — nothing you paste here is transmitted, logged, or stored.
Frequently asked questions
How many bits should a JWT secret be?
The JWA standard requires an HS256 key of at least 256 bits (32 bytes), HS384 of at least 384 bits (48 bytes), and HS512 of at least 512 bits (64 bytes). Generating at or above those sizes satisfies the specification regardless of the library or identity provider you use.
Where should I store the generated secret?
In an environment variable on your server, never in client-side code or a public repository. For production, prefer a secrets manager or the environment-variable mechanism of your hosting platform, and rotate the value when anyone with access leaves the team.
Is a random string generated in the browser secure?
Yes — the tool uses the browser's crypto.getRandomValues, which draws from a cryptographically secure source of randomness, not Math.random(). A 256-bit value from it has enough entropy that it cannot be guessed or brute-forced in practice.
Base64, Base64URL, or hex — which format should I use?
Any of them works as a JWT secret because the library decodes the string to bytes before using it. Base64URL is the most common choice in Node.js and JWT examples; hex is convenient when the value is generated by OpenSSL or a password manager.
Quick comparison
Random JWT secret vs predictable passphrase — why it matters
A JWT signing secret must be long and random. If it is short or guessable, an attacker can brute-force it and forge tokens with any claims they want — effectively taking over any session, including admin accounts.
| Aspect | Random secret (generator) | Passphrase / short key |
|---|---|---|
| Entropy | 256-512 bits from crypto.getRandomValues | Often < 40 bits — guessable |
| Brute-force | Not feasible in practice | Feasible with dictionary / GPU attacks |
| JWT recommendation | Matches or exceeds JWA minimums | Usually below HS256 requirement |
| Compromise impact | Token forgery prevented | Attacker can mint valid tokens |
| Right use | JWT signing, API secrets, security keys | Human accounts, lower-stakes auth |
How to generate a JWT secret in 3 steps
Your JWT signing secret should be a long, cryptographically random value — not a passphrase or a memorable word. Weak or guessable secrets let attackers forge tokens and take over sessions.
- 1Pick the key size that matches the algorithm you sign with: 32 bytes for HS256, 48 bytes for HS384, 64 bytes for HS512. Meeting (or exceeding) these sizes satisfies the JWA minimum.
- 2Choose an output format — Base64URL is the most common in Node.js and JWT libraries; hex works too. The secret is regenerated automatically whenever you change the size.
- 3Copy the value into your server's environment variables or secrets manager. Never commit it to a repository, and treat it like a password.