JWT Secret Key Generator
Generate cryptographically secure JWT secret keys for HS256, HS384, and HS512 signing in Base64, Base64URL, or Hex, ready to paste into your .env file.
Secret Key Options
Keys are generated in your browser with the Web Crypto API and are never sent to a server. Store secrets in environment variables or a secrets manager. Never commit them to source control.
How to Use the JWT Secret Key Generator
- Choose a signing algorithm (HS256, HS384, or HS512). The key length is set to that algorithm's minimum automatically.
- Optionally pick a longer key length using the presets or the number field.
- Select the output encoding (Base64, Base64URL, or Hex) and set the environment variable name.
- Copy the secret or the ready-made .env line, or use the OpenSSL or Node.js command to generate an equivalent key locally.
JWT Secret Key Generator Features
- Uses Web Crypto API (crypto.getRandomValues)
- HS256, HS384, and HS512 presets with RFC 7518 minimum key sizes
- Base64, Base64URL, and Hex output encodings
- Ready-to-paste .env entry plus OpenSSL and Node.js equivalents
Frequently Asked Questions
How long should a JWT secret key be?
RFC 7518 requires an HMAC key to be at least as long as the hash output: 256 bits (32 bytes) for HS256, 384 bits (48 bytes) for HS384, and 512 bits (64 bytes) for HS512. Longer keys are fine. Shorter keys weaken the signature and are rejected by some libraries.
Which encoding should I choose?
Base64, Base64URL, and Hex are just different text representations of the same random bytes. Use whichever format your JWT library or configuration expects. If the library decodes the secret first (for example, a Base64-encoded key), choose the matching encoding.
Is it safe to generate a secret in the browser?
Keys are created locally with the Web Crypto API's secure random generator and are never sent to a server. For production systems, you can also run the OpenSSL or Node.js command shown on a trusted machine. Store the key in environment variables or a secrets manager, and rotate it if it's ever exposed.
What's the difference between HS256 and RS256?
HS256 is symmetric: the same shared secret both signs and verifies tokens. RS256 and ES256 are asymmetric: a private key signs tokens and a public key verifies them. This tool generates secrets for the HMAC (HS) algorithms only.