---
title: "JWT Secret Generator – pwgen.de"
description: "Keys for HS256 and HS512, at least as long as the hash output."
canonical_url: "https://pwgen.de/en/jwt-secret-generator"
meta:
  "og:description": "Keys for HS256 and HS512, at least as long as the hash output."
  "og:image": "https://pwgen.de/_og/s/o_fdc7e8d7adb96163.png"
  "og:image:height": "630"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "JWT Secret Generator – pwgen.de"
  "twitter:image": "https://pwgen.de/_og/s/o_fdc7e8d7adb96163.png"
---

> Index of every page on this site: [llms.txt](https://pwgen.de/llms.txt)

# **JWT Secret Generator**

Keys for HS256 and HS512, at least as long as the hash output.

Very strong**0 bits**Generated in your browser

## **Local alternative**

`openssl rand -base64 32`

Prefer generating secrets on the machine that uses them? This command produces an equivalent value.

[Official documentation](https://datatracker.ietf.org/doc/html/rfc7518#section-3.2)

For HMAC-signed JSON Web Tokens the key length determines how secure the signature is. RFC 7518 requires a key at least as long as the hash output: 32 bytes for HS256, 64 bytes for HS512. Using a short, human-readable passphrase as a JWT secret is a common and serious mistake, because it can be brute-forced offline.

## **Frequently asked questions**

At least as long as the output of the hash function in use — that is what RFC 7518 §3.2 requires. For HS256 that means 32 bytes, for HS512 64 bytes. Shorter keys measurably weaken the scheme.

Better not. Anyone holding the key can mint valid tokens for every service that accepts it. A separate key per application confines the damage of a leak.

They become invalid immediately, because their signature no longer verifies. To avoid that you need key rotation with a key ID in the token header, accepting old and new keys side by side for a while.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://pwgen.de/en#website","@type":"WebSite","description":"Kostenloser, datenschutzfreundlicher Passwort-Generator. Generierung direkt im Browser – keine Passwörter werden gespeichert.","inLanguage":"en-US","name":"pwgen.de","url":"https://pwgen.de/en","publisher":{"@id":"https://pwgen.de/#identity"},"translationOfWork":{"@id":"https://pwgen.de/#website"}},{"@id":"https://pwgen.de/en/jwt-secret-generator#webpage","description":"Keys for HS256 and HS512, at least as long as the hash output.","name":"JWT Secret Generator","url":"https://pwgen.de/en/jwt-secret-generator","@type":["WebPage","FAQPage"],"breadcrumb":{"@id":"https://pwgen.de/en/jwt-secret-generator#breadcrumb"},"isPartOf":{"@id":"https://pwgen.de/en#website"},"mainEntity":[{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/question/1"},{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/question/2"},{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/question/3"}],"potentialAction":[{"@type":"ReadAction","target":["https://pwgen.de/en/jwt-secret-generator"]}],"primaryImageOfPage":{"@id":"https://pwgen.de/#logo"}},{"@id":"https://pwgen.de/#identity","@type":"Organization","email":"info@htrs.io","legalName":"GbR HTRS i/o","name":"HTRS i/o","telephone":"+49 221 292 513 03","url":"https://pwgen.de","vatID":"DE359532582","address":{"@type":"PostalAddress","streetAddress":"Gotenring 9","addressLocality":"Köln","postalCode":"50679","addressCountry":"DE"},"logo":{"@id":"https://pwgen.de/#logo"},"sameAs":["https://htrs.io"]},{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/software-application/1","@type":"SoftwareApplication","applicationCategory":"DeveloperApplication","name":"pwgen.de – JWT Secret Generator","operatingSystem":"Web Browser","offers":{"@type":"Offer","availability":"https://schema.org/InStock","price":"0","priceCurrency":"EUR","priceValidUntil":"2027-12-30T00:00:00.000Z"}},{"@id":"https://pwgen.de/en/jwt-secret-generator#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"pwgen.de","item":"https://pwgen.de/en","position":1},{"@type":"ListItem","name":"Secrets","item":"https://pwgen.de/en/secrets","position":2},{"@type":"ListItem","name":"JWT Secret Generator","position":3}]},{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/question/1","@type":"Question","inLanguage":"en","name":"How long does an HMAC secret for JWT need to be?","acceptedAnswer":{"@type":"Answer","text":"At least as long as the output of the hash function in use — that is what RFC 7518 §3.2 requires. For HS256 that means 32 bytes, for HS512 64 bytes. Shorter keys measurably weaken the scheme."}},{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/question/2","@type":"Question","inLanguage":"en","name":"Can I use the same key for several services?","acceptedAnswer":{"@type":"Answer","text":"Better not. Anyone holding the key can mint valid tokens for every service that accepts it. A separate key per application confines the damage of a leak."}},{"@id":"https://pwgen.de/en/jwt-secret-generator#/schema/question/3","@type":"Question","inLanguage":"en","name":"What happens to issued tokens after a rotation?","acceptedAnswer":{"@type":"Answer","text":"They become invalid immediately, because their signature no longer verifies. To avoid that you need key rotation with a key ID in the token header, accepting old and new keys side by side for a while."}},{"@id":"https://pwgen.de/#logo","@type":"ImageObject","caption":"HTRS i/o","contentUrl":"https://pwgen.de/apple-touch-icon.png","inLanguage":"en","url":"https://pwgen.de/apple-touch-icon.png"}]}
```

## Sitemap

See the full [sitemap](https://pwgen.de/sitemap.md) for all pages.