Tool

JWT Secret Generator

RFC 7518–aware secrets for HS256/HS384/HS512. Output as base64url, hex, or base64 — client-side only.

Last updated July 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Algorithm (RFC 7518 minimum)

Quick select

Custom length256 bits / 32 bytes

256512

Output format

Generated secret256-bit · HS256 · HS256 standard

Length or algorithm changed — click "Generate secret" for a new key

CLI equivalents (32 bytes · base64url)

openssl rand -base64 32 | tr '+/' '-_' | tr -d '='

Press R to regenerate · crypto.getRandomValues() — no data leaves your browser.

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Choose HS256, HS384, or HS512. The generator enforces RFC 7518 minimum key lengths (32 / 48 / 64 bytes) so you cannot accidentally create an undersized secret for the selected algorithm.

Pick an output format: base64url (default, JWT-friendly), hex, or standard base64. Click Generate to create a cryptographically random secret with crypto.getRandomValues(). Use Reveal to show the full value, Copy to copy the secret, or Copy for .env to copy a JWT_SECRET=… line.

Paste the secret into your deployment environment (never hardcode it). Optional CLI snippets below the widget show equivalent openssl, Node.js, and Python one-liners for the same size and format.

const jwt = require('jsonwebtoken');

const secret = 'YOUR_GENERATED_SECRET_HERE';

// Sign a token
const token = jwt.sign(
  { userId: 123, role: 'user' },
  secret,
  { algorithm: 'HS256', expiresIn: '1h' }
);

// Verify a token
const payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
console.log(payload); // { userId: 123, role: 'user', iat: ..., exp: ... }

const jwt = require('jsonwebtoken');

const secret = 'YOUR_GENERATED_SECRET_HERE';

// Sign a token
const token = jwt.sign(
  { userId: 123, role: 'user' },
  secret,
  { algorithm: 'HS256', expiresIn: '1h' }
);

// Verify a token
const payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
console.log(payload); // { userId: 123, role: 'user', iat: ..., exp: ... }

import jwt

secret = 'YOUR_GENERATED_SECRET_HERE'

# Sign a token
token = jwt.encode(
    {'userId': 123, 'role': 'user'},
    secret,
    algorithm='HS256'
)

# Verify a token
payload = jwt.decode(token, secret, algorithms=['HS256'])
print(payload)  # {'userId': 123, 'role': 'user'}

import "github.com/golang-jwt/jwt/v4"

secret := []byte("YOUR_GENERATED_SECRET_HERE")

// Sign a token
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
    "userId": 123,
    "role":   "user",
})
tokenString, err := token.SignedString(secret)

// Verify a token
parsed, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
    return secret, nil
})

What is a JWT secret key?

A JWT secret key is a cryptographic value used to sign JSON Web Tokens with HMAC algorithms like HS256, HS384, or HS512. The secret must be kept private — anyone with the secret can forge valid tokens, granting unauthorized access to your application.

How long should my JWT secret be?

RFC 7518 recommends at least 256 bits (32 bytes) for HS256, 384 bits for HS384, and 512 bits for HS512. This generator enforces those floors when you select an algorithm. Never use a human-readable passphrase as a JWT secret.

What is base64url output?

Base64URL is a URL-safe Base64 variant (RFC 4648) that replaces + and / with - and _ and typically omits = padding. Many JWT libraries accept secrets as strings in hex or base64url. Prefer base64url when pasting into env vars that may travel in shell-friendly contexts.

Copy for .env vs Copy secret?

Copy secret copies only the encoded key. Copy for .env copies JWT_SECRET=<key> so you can paste directly into a .env file. Always keep .env files out of version control and prefer a secrets manager in production.

Is this generator safe to use?

Yes. All key generation happens entirely in your browser using the Web Crypto API — a native, audited cryptographic API built into all modern browsers. No data is ever sent to any server. You can verify this by opening your browser's developer tools, going to the Network tab, and confirming there are no outbound requests when you generate a key.

Where should I store my JWT secret?

Store it as an environment variable in your deployment environment (e.g., JWT_SECRET=your-key in a .env file, or in your hosting platform's secrets manager). Never hardcode it in source code or commit it to a repository. For production systems, use a dedicated secrets manager like AWS Secrets Manager, HashiCorp Vault, or GCP Secret Manager.

Can I use the same JWT secret for multiple environments?

No. Always generate separate, unique secrets for development, staging, and production environments. This limits the blast radius if one environment is compromised — an attacker who obtains your staging secret cannot forge tokens against your production API.

How do I generate a JWT secret?

Use this tool to produce a cryptographically random key (256 bits minimum for HS256), then store it as an environment variable such as JWT_SECRET. Sign tokens server-side with a JWT library — never embed the secret in client-side code.

What happens if I change the algorithm or length after generating?

The previous secret is cleared so you never copy a key that no longer matches the selected RFC 7518 size. Click Generate (or press R) to create a new secret at the updated length.

Can I regenerate with a keyboard shortcut?

Yes. After interacting with the generator (and when you are not typing in a text field), press R to regenerate a new secret with the current algorithm, length, and format.

Is a JWT secret the same as an API key?

No. A JWT secret signs tokens so verifiers can trust their integrity. An API key identifies a client to an API. They serve different purposes and should be separate random values with different rotation policies.

Continue learning

ToolsJWT EncoderJWT ValidatorSession Secret GeneratorJWKS Viewer

GuidesGenerate a JWT Secret in 5 MinutesStore JWT Secrets — Security ChecklistRotate JWT Secrets Without DowntimeNode.jsPythonGoJavaRuby

ArticlesHow to Generate a JWT Secret KeyWhat Size JWT Secret Do I Need?JWT Best Practices ChecklistHow to Rotate JWT Secrets

GlossaryJWT Secret KeyHS256 (HMAC-SHA256)HMAC (Hash-based Message Authentication Code)Base64URL Encodingkid (Key ID) ClaimJSON Web Token (JWT)JWT Secret EntropySigning Key CompromiseKey Rotation with kid

CompareHS256 vs RS256JWT vs Session CookiesSymmetric vs Asymmetric JWT SigningHex vs Base64 JWT SecretsHS256 vs ES256

AlgorithmsHS256 (HMAC-SHA256)HS384 (HMAC-SHA384)HS512 (HMAC-SHA512)

ResourcesProduction JWT path

How to Use This Tool

Continue learning