JWT Secret Generator
Keys for HS256 and HS512, at least as long as the hash output.
Very strong0 bitsGenerated in your browser
Local alternative
openssl rand -base64 32Prefer generating secrets on the machine that uses them? This command produces an equivalent value.
Official documentationFor HMAC-signed JSON Web Tokens the key length determines how secure the signature is. RFC 7518 requires a key at least as long as the hash output: 32 bytes for HS256, 64 bytes for HS512. Using a short, human-readable passphrase as a JWT secret is a common and serious mistake, because it can be brute-forced offline.
Frequently asked questions
At least as long as the output of the hash function in use — that is what RFC 7518 §3.2 requires. For HS256 that means 32 bytes, for HS512 64 bytes. Shorter keys measurably weaken the scheme.
Better not. Anyone holding the key can mint valid tokens for every service that accepts it. A separate key per application confines the damage of a leak.
They become invalid immediately, because their signature no longer verifies. To avoid that you need key rotation with a key ID in the token header, accepting old and new keys side by side for a while.