JWT Secret Generator
Generate secure random secrets for JWT signing
Choose a Tool
Generate secure random secrets for JWT signing. All processing happens locally in your browser - no data is sent to any server.
How to generate a JWT signing secret
Pick a length, generate, and copy. The table shows how long it needs to be for each algorithm.
- 01
Choose a length in characters
The field takes 8 to 128 characters and starts at 32. For HS256, pick at least 40 if you want the secret's randomness, not just its length, to reach 256 bits (see the table below).
- 02
Generate the secret
Each character is drawn from 88 options: upper and lower case letters, digits and 26 symbols. The randomness comes from crypto.getRandomValues, the browser's cryptographic random source.
- 03
Copy it into your secret store, quoted
Paste it into your .env file or secret manager. Wrap it in single quotes in a .env file, because symbols such as # and $ have special meaning to many .env parsers.
Length versus real randomness
RFC 7518 says an HMAC key must be at least as long as the hash output: 256 bits for HS256. A 32-character secret is 32 bytes, so it meets that rule on length. But each character here carries log₂(88) ≈ 6.46 bits of randomness, not 8, so 32 characters hold about 207 random bits.
That's still far beyond what anyone can brute-force. If you want the randomness itself to match the hash size, though, use the character counts in this table.
| Characters | Randomness | What it's good for |
|---|---|---|
| 16 | 103 bits | Too short for a signing key |
| 32 (default) | 207 bits | 256 bits of key length for HS256, 207 bits of randomness |
| 40 | 258 bits | Full 256-bit strength for HS256 |
| 60 | 388 bits | Full strength for HS384 |
| 80 | 517 bits | Full strength for HS512 |
| 128 (max) | 827 bits | More than any HMAC algorithm needs |
When you need Base64 or hex instead
This generator only produces printable characters. Some frameworks expect the secret as Base64 or as hex bytes. If yours does, the simplest route is your terminal: openssl rand -base64 48 or openssl rand -hex 32 gives you random bytes in exactly that format.
Don't take a printable secret from here and then Base64-encode it to satisfy a format check. It'll work, but the server will decode it back to the same characters, and the randomness won't change.
Where a random secret is needed
Starting a new auth service
NextAuth, Passport and Django all need a signing secret on day one. A random one beats a word or phrase someone could guess.
Rotating a leaked or old key
If a secret was committed to Git or shared in chat, generate a fresh one, deploy it, and expire tokens signed with the old one.
Signing webhooks
Webhook senders and receivers share an HMAC secret. Generate it here and store it on both sides.