Generate Secure JWT Secret Keys
Cryptographically secure random key generation, JWT encoding and validation, hashing, and more — all running in your browser.
Security Tools
16 tools — all run locally in your browser. Pin generators to your board above.
JWT
Crypto
Session / CSRF Secret Generator
Generate cryptographically secure session and CSRF secrets (32–64 bytes).
Use NowHash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser.
Use NowAPI Key Generator
Generate secure API keys in UUID, hex, alphanumeric, or Base64 format with custom prefixes.
Use NowIdentity
Encoding
What we don’t replace
JWTSecrets is a free, client-side workbench for developers. Honest limits keep the product focused — and keep your production secrets where they belong.
Password managers
We generate secrets for apps and APIs — not a vault for personal logins, autofill, or sync across devices.
Enterprise secret stores
Production systems need AWS Secrets Manager, Vault, or cloud KMS for access control, audit trails, and rotation.
Automated key rotation
Browser tools cannot rotate live signing keys or update JWKS for you. Use kid-based rotation in your auth stack.
Prefer a secrets manager for production? Compare options in our env vars vs Vault guide.
Anatomy of a JWT
Every JWT is three Base64URL segments joined by dots — header, payload, and signature.
Security Best Practices
Three pillars of JWT secret key security.
Use Strong Keys
Use at least 256-bit cryptographically random secrets. Weak or guessable keys can be brute-forced offline.
Regular Rotation
Rotate JWT secrets periodically using the kid header for zero-downtime key transitions.
Secure Storage
Store secrets in environment variables or a dedicated secrets manager. Never hardcode in source code.
JWKS rotation with kid
Understanding JWT Secret Keys
Security essentials every developer should know.
What is a JWT secret key?
A cryptographic key used to sign and verify JSON Web Tokens, ensuring their integrity and authenticity.
How long should my JWT secret be?
Minimum 256 bits (32 bytes) for HS256. Use 512 bits for HS512 or high-security environments.
HS256 vs RS256?
HS256 uses a single shared secret. RS256 uses a private/public key pair — better for microservices and third-party verification.
JWT vs session cookies?
JWTs are self-contained and scale across services; session cookies keep server-side state and are often simpler to revoke. Pick based on architecture, not hype.
Where should I store JWT secrets?
Use environment variables for simple setups. For production, compare Vault, cloud KMS, and env vars in our storage guides.
What is Base64URL encoding?
A URL-safe variant of Base64 used in JWT header and payload segments. Padding is optional and +/ are replaced.