JWT Secret Generator
Privacy note: Your secret is generated in this browser. This tool does not send it to the server or save it in browser storage.
Generate a random symmetric signing secret for an HS256, HS384, or HS512 JSON Web Token. This tool does not create a JWT, an RSA key pair, or VAPID keys.
The result is hidden until you reveal it. Copy only to your own trusted application configuration.
Which secret size should I choose?
Use at least 32 random bytes for HS256, 48 for HS384, and 64 for HS512. These presets match the minimum key sizes in RFC 7518. Random bytes determine entropy; encoded character counts do not increase it.
For 32 random bytes, Base64URL produces 43 characters, padded Base64 produces 44, and hexadecimal produces 64. They represent the same 256 bits of randomness.
How do I use an encoded HMAC secret?
Check your JWT library: some libraries expect the encoded text as the secret, while others require decoding it into bytes first. Use the same interpretation when signing and verifying. Never use a JWT itself as its signing secret.
How should I store and rotate the secret?
Keep signing secrets in a secret manager or protected application configuration. Do not commit them to Git, paste them into URLs, or include them in logs. Anyone holding an HMAC secret can create valid signatures.
Changing an application signing secret may invalidate existing tokens. Plan rotation with your application before replacing a deployed secret. Generating a value here does not change any application.
Clearing this page does not erase the system clipboard. Secret values are cleared when leaving the page or changing an option.