What is a JWT secret key?

A JWT secret key is a cryptographic value used to sign JSON Web Tokens with HMAC algorithms like HS256, HS384, or HS512. The secret must be kept private — anyone with the secret can forge valid tokens, granting unauthorized access to your application.

How long should my JWT secret be?

RFC 7518 recommends at least 256 bits (32 bytes) for HS256, 384 bits for HS384, and 512 bits for HS512. This generator enforces those floors when you select an algorithm. Never use a human-readable passphrase as a JWT secret.

What is base64url output?

Base64URL is a URL-safe Base64 variant (RFC 4648) that replaces + and / with - and _ and typically omits = padding. Many JWT libraries accept secrets as strings in hex or base64url. Prefer base64url when pasting into env vars that may travel in shell-friendly contexts.

Copy for .env vs Copy secret?

Copy secret copies only the encoded key. Copy for .env copies JWT_SECRET= so you can paste directly into a .env file. Always keep .env files out of version control and prefer a secrets manager in production.

Is this generator safe to use?

Yes. All key generation happens entirely in your browser using the Web Crypto API — a native, audited cryptographic API built into all modern browsers. No data is ever sent to any server. You can verify this by opening your browser's developer tools, going to the Network tab, and confirming there are no outbound requests when you generate a key.

Where should I store my JWT secret?

Store it as an environment variable in your deployment environment (e.g., JWT_SECRET=your-key in a .env file, or in your hosting platform's secrets manager). Never hardcode it in source code or commit it to a repository. For production systems, use a dedicated secrets manager like AWS Secrets Manager, HashiCorp Vault, or GCP Secret Manager.

Can I use the same JWT secret for multiple environments?

No. Always generate separate, unique secrets for development, staging, and production environments. This limits the blast radius if one environment is compromised — an attacker who obtains your staging secret cannot forge tokens against your production API.

How do I generate a JWT secret?

Use this tool to produce a cryptographically random key (256 bits minimum for HS256), then store it as an environment variable such as JWT_SECRET. Sign tokens server-side with a JWT library — never embed the secret in client-side code.

What happens if I change the algorithm or length after generating?

The previous secret is cleared so you never copy a key that no longer matches the selected RFC 7518 size. Click Generate (or press R) to create a new secret at the updated length.

Can I regenerate with a keyboard shortcut?

Yes. After interacting with the generator (and when you are not typing in a text field), press R to regenerate a new secret with the current algorithm, length, and format.

Is a JWT secret the same as an API key?

No. A JWT secret signs tokens so verifiers can trust their integrity. An API key identifies a client to an API. They serve different purposes and should be separate random values with different rotation policies.

Herramienta

Generador de secretos JWT

Secretos alineados con RFC 7518 para HS256/HS384/HS512. Salida en base64url, hex o base64 — solo en el cliente.

Last updated July 1, 2026

Se ejecuta por completo en tu navegador — no se envían datos a servidores. Política de privacidad

Los controles de la herramienta permanecen en inglés por precisión. La generación no sale de tu navegador.

Algorithm (RFC 7518 minimum)

Quick select

Custom length256 bits / 32 bytes

256512

Output format

Generated secret256-bit · HS256 · HS256 standard

Length or algorithm changed — click "Generate secret" for a new key

CLI equivalents (32 bytes · base64url)

openssl rand -base64 32 | tr '+/' '-_' | tr -d '='

Press R to regenerate · crypto.getRandomValues() — no data leaves your browser.

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Página completa en inglés con guías y preguntas frecuentes