Advertisement
Free JWT Secret Generator: create secure JWT_SECRET keys for HS256, HS384 and HS512 in Base64, Hex or ASCII, generated locally with the Web Crypto API.
Generate cryptographically secure signing secrets locally
Your secrets appear here, ready to copy.
No secrets yet
Choose your settings, then select Generate.
1× 43 characters, 256 bits
Generated locally
Secrets are generated with your browser's Web Crypto API and are not sent to this server. Store production secrets in environment variables or a dedicated secret manager. Never commit them to source control.
JWT Secret Generator creates production-ready JWT signing secrets (the value you store as JWT_SECRET) with the Web Crypto API — fully client-side, no data ever sent to a server. Choose from 128-bit to 512-bit key lengths and output in Base64 (URL-safe), Hexadecimal, or ASCII. Designed for HS256, HS384, and HS512 HMAC algorithms. Supports batch generation for key rotation workflows and one-click copy for fast integration into .env files or secret managers like AWS Secrets Manager, Doppler, or Vault.
What you get with JWT Secret Generator.
Select 256, 384, or 512-bit keys to exactly match your JWT algorithm's minimum requirement — no guesswork.
Pick Base64 (URL-safe) for modern frameworks, Hex for legacy systems, or ASCII for custom implementations.
All secrets are generated using the Web Crypto API locally. Nothing is transmitted to any server.
Generate up to 10 secrets at once to support key rotation strategies without repeating manual steps.
Follow these steps to get the best results.
Select HS256, HS384, or HS512 — the tool defaults to a matching minimum key length for that algorithm.
Choose Base64 (URL-safe) for most frameworks, Hex for legacy systems, or ASCII for custom implementations.
Generate one secret or a batch of up to 10, then copy the result into your .env file as JWT_SECRET=your_key_here.
Advertisement
Common questions about JWT Secret Generator.
A JWT secret key is a cryptographic key used to sign JSON Web Tokens (JWTs) with HMAC algorithms like HS256, HS384, or HS512. It verifies that the token wasn't tampered with. The server signs the token on issue, then re-verifies the signature on each request.
Select your algorithm (HS256/384/512) and output format (Base64/Hex/ASCII), then click Generate. Copy the result and paste it into your .env file as JWT_SECRET=your_key_here.
Use at least 256-bit for HS256, 384-bit for HS384, and 512-bit for HS512. RFC 7518 requires the HMAC key to be at least as long as the hash output. Shorter keys will cause validation failures in strict JWT libraries.
Base64 (URL-safe) is recommended for most frameworks including Node.js, Next.js, and Python. Use Hex if your system or library requires hex strings. ASCII is useful for systems with character-encoding constraints.
Yes — this tool runs entirely in your browser using the Web Crypto API. No secrets are sent to any server or logged anywhere. You can verify this by running it offline after the page loads.
Copy the secret and paste it into your .env file as JWT_SECRET=your_secret_here. In Node.js, access it via process.env.JWT_SECRET and pass it to your JWT library (e.g., jsonwebtoken: jwt.sign(payload, process.env.JWT_SECRET, { algorithm: 'HS256' })).
Key rotation is the practice of periodically replacing your JWT secret with a new one to limit exposure if a key is compromised. Use the batch generation feature to generate replacement keys and update them in your secret manager (AWS Secrets Manager, Doppler, Vault, etc.) without downtime.
Yes. Those variables only need a long random string, and a 256-bit key in Base64 works well. Generate one here, paste it into your .env file (for example JWT_SECRET=...), and never commit it to Git. In a terminal, openssl rand -base64 32 produces an equivalent 32-byte value.
Advertisement
Comments
Share feedback, ask questions, or help others use this tool.
Join the discussion
Sign in to comment, reply, and report inappropriate content.