Free Password Generator
Generate a random password or PIN in your browser. Choose the length and characters, then copy it.
Free JWT Secret Key Generator
Generate a secure JWT signing secret for HS256, HS384 or HS512 in seconds.
Quick presets
HS256 requires at least 32 random bytes (256 bits).
Generate a JWT secret key for the HMAC algorithm your application uses. Choose HS256, HS384 or HS512, select a key size, and copy a cryptographically random signing secret. Free to use, with no account required.
- Random key generation with your browser’s Web Crypto API
- 256-bit, 384-bit, 512-bit and 1024-bit quick presets
- Copy the full secret in Base64URL, Base64 or hex
How to generate a JWT secret key
- Select HS256, HS384 or HS512 Choose the algorithm used by your JWT signer and verifier. The generator starts with its minimum key size: 32 bytes for HS256, 48 for HS384 or 64 for HS512.
- Choose a key-size preset Select 256, 384, 512 or 1024 bits, or adjust the byte count with the slider. Presets below the selected algorithm’s minimum are disabled. One byte equals eight bits.
- Pick your output format Use the format selector in the footer to choose Base64URL, Base64 or hex. Base64URL is the default. Changing the format displays the same random bytes in a different encoding.
- Copy your signing secret Select Copy to copy the full key, even when its middle is hidden. Use the eye icon to reveal it. Generate again creates a fresh key; save the key your application will use before leaving the page.
What is a JWT secret key?
A JWT secret key is the shared key used to sign and verify JSON Web Tokens with an HMAC algorithm. Your server signs a token containing claims such as a user identifier. A verifier checks the signature with the same key to detect changes to the signed content.
Signing a JWT protects its integrity; it does not encrypt its contents. The header and payload of an HMAC-signed JWT can be decoded without the secret. Keep confidential information out of readable token claims.
Use a randomly generated key instead of a name, project title or memorable password. A predictable secret can be guessed, allowing someone to forge signatures. The generator creates a signing key; your application’s JWT library uses that key to issue and verify tokens.
JWT secret key lengths for HS256, HS384 and HS512
HS256: at least 256 bits (32 bytes)
HS256 uses HMAC with SHA-256. Select the 256-bit preset when your application uses HS256, or choose a larger key. A 32-byte random key meets the algorithm’s minimum size.
HS384: at least 384 bits (48 bytes)
HS384 uses HMAC with SHA-384 and requires at least 48 key bytes. Selecting HS384 sets that size automatically. The 256-bit preset is disabled for this algorithm.
HS512: at least 512 bits (64 bytes)
HS512 uses HMAC with SHA-512 and requires at least 64 key bytes. You can also choose the 1024-bit preset. Increasing key size does not change the signing algorithm; match the algorithm configured in your application.
These minimums follow RFC 7518 section 3.2, which requires an HMAC key at least as large as the hash output. This generator enforces the selected algorithm’s minimum and allows up to 128 random bytes (1024 bits).
Base64URL, Base64 or hex: which JWT secret format should you use?
- Base64URL Compact text using letters, numbers, hyphens and underscores, without padding. A 256-bit key is 43 characters in this format.
- Base64 Standard Base64 can include plus signs, slashes and trailing equals signs. The same 256-bit key is 44 characters with padding.
- Hexadecimal Lowercase text using 0–9 and a–f. Each byte becomes two characters, so a 256-bit key is 64 hex characters.
All three formats encode the same random key bytes. Hex has more characters than Base64URL, but it does not have more entropy. Choose the representation your application expects.
Some JWT libraries use secret strings as literal text; others accept decoded key bytes. Use the copied string consistently for signing and verification, or decode it consistently on both sides. Re-encoding an existing secret and then using the new text as a literal key will change that key.
How to store and rotate your JWT signing secret
Store the key in your server’s environment or a secrets manager. JWT_SECRET is a common environment-variable name; use the name your application expects. Keep it out of committed source files, logs and frontend bundles. Anyone with the HMAC secret can create valid signatures.
Generate separate secrets for development, staging and production. This limits which systems are affected if one environment’s key is exposed.
Rotate a secret when it is exposed and according to your application’s key-management policy. Changing a deployed signing key can invalidate existing tokens. If you need a transition period, configure your application to sign with the new key while temporarily accepting the previous one.
Generate again only creates a value on this page. It does not change your server configuration or rotate a deployed key. Update the signer and verifier together when deploying a replacement.
How this JWT secret generator creates random keys
The generator obtains random bytes from crypto.getRandomValues, the browser’s cryptographic random-number API. It then encodes those bytes in your selected output format. It does not build secrets from predictable words or personal details.
Keys are generated in your browser after the page loads. This tool does not send generated values to a server or save them in browser storage. Copying places the full secret on your device’s clipboard.