Generate Secure JWT Secret Keys
Cryptographically secure random key generation, JWT encoding and validation, hashing, and more — all running in your browser.
JWT Secret Generator
Cryptographically secure keys via the Web Crypto API — runs entirely in your browser.
All generation happens client-side. No data is sent to any server.
Security Tools
14 tools — all run locally in your browser.
JWT
JWT Token Validator
Validate JWT tokens, verify signatures, check expiration, and inspect header and payload claims.
Use NowCrypto
Identity
Encoding
Anatomy of a JWT
Every JWT is three Base64URL segments joined by dots — header, payload, and signature.
Security Best Practices
Three pillars of JWT secret key security.
Use Strong Keys
Use at least 256-bit cryptographically random secrets. Weak or guessable keys can be brute-forced offline.
Regular Rotation
Rotate JWT secrets periodically using the kid header for zero-downtime key transitions.
Secure Storage
Store secrets in environment variables or a dedicated secrets manager. Never hardcode in source code.
JWKS rotation with kid
Understanding JWT Secret Keys
Security essentials every developer should know.
What is a JWT secret key?
A cryptographic key used to sign and verify JSON Web Tokens, ensuring their integrity and authenticity.
How long should my JWT secret be?
Minimum 256 bits (32 bytes) for HS256. Use 512 bits for HS512 or high-security environments.
HS256 vs RS256?
HS256 uses a single shared secret. RS256 uses a private/public key pair — better for microservices and third-party verification.
Where should I store JWT secrets?
Use environment variables for simple setups. For production, compare Vault, cloud KMS, and env vars in our storage guides.
What is Base64URL encoding?
A URL-safe variant of Base64 used in JWT header and payload segments. Padding is optional and +/ are replaced.
What is a refresh token?
A long-lived credential used to obtain new access tokens without re-authenticating the user.