Calculator
What the JWT Secret Generator does
JWT Secret Generator: generates JWT signing secret from Length. Example: length 64 gives JWT signing secret 63LYaLhKwdnJf7pNxhbUU0GoUwMxhQIQgmcDeXS0RSbCiFXrNz559NClT9HEO2p8.
The JWT Secret Generator takes Length and returns JWT signing secret. Enter what you need and trigger it when you are ready.
Most people who open the JWT Secret Generator are people rotating an API key. Randomness quality matters here in a way it does not for most tools.
The value is created locally from your browser cryptographic random source and is never sent to us.
Further down the page: what each field expects, how the result is derived, and one example worked from the defaults.
What do the JWT Secret Generator fields mean?
The JWT Secret Generator uses 1 input. Pre-filled inputs double as documentation: each one shows what a reasonable value looks like.
| Field | What to enter | Default |
|---|---|---|
| Length | accepts 8 to 256 | 64 |
How does the JWT Secret Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
Checks happen up front, so errors surface next to the form instead of hiding in the output.
Worked example
These are the values the JWT Secret Generator loads by default, and the result it produces from them. This is the worked example the page starts from, reproduced here so you can check the arithmetic.
| Length | 64 |
|---|
| JWT signing secret | 63LYaLhKwdnJf7pNxhbUU0GoUwMxhQIQgmcDeXS0RSbCiFXrNz559NClT9HEO2p8 |
|---|
A signing secret, not an encryption key
This generates a long random string suited to HMAC-based JWT signing (HS256, HS384, HS512): the symmetric secret that both issues and verifies a token’s signature.
Worth knowing
- RFC 7518 recommends an HMAC key at least as long as the hash’s output: 256 bits (32 bytes) for HS256, 384 for HS384, 512 for HS512. The default 64-character output here, drawn from a 64-character pool, comfortably clears that bar for all three.
- A well-documented class of real JWT vulnerabilities comes from weak or default signing secrets ("secret", "changeme", or a company name), that attackers recover by brute-forcing against a captured token, then use to forge arbitrary valid tokens. A long random secret from a generator like this closes exactly that hole.
- HS256 is symmetric: anything able to verify a token is also able to forge one, since signing and verification use the same secret. If services need to verify tokens without being able to mint new ones, use an asymmetric algorithm (RS256, ES256) with a public/private key pair. A shared HMAC secret is the wrong tool for that.
- Treat this secret exactly like a database password: an environment variable or secrets manager, never committed to source control, rotated immediately if it is ever exposed.
How to use it
- Put Length (8 to 256).
- Press Generate.
- The results panel then shows JWT signing secret.
- Copy Link puts the current inputs in the URL, so bookmarking it brings the same numbers back.
What this tool does not do
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- Randomness comes from your browser's cryptographic random source, which is suitable for passwords and keys.
- Defaults are illustrative starting points, not recommendations.
- Check that each figure is in the unit the label asks for; that is the most common source of a wrong result.
Frequently asked questions
One thing: Length. Every box already holds a working value, which means a single edit is enough to get a meaningful answer.
Length accepts 8 to 256. Values outside that range are rejected with a message naming the field, rather than producing something that looks valid but is not.
With the values loaded when the page opens, JWT signing secret comes out as 63LYaLhKwdnJf7pNxhbUU0GoUwMxhQIQgmcDeXS0RSbCiFXrNz559NClT9HEO2p8. The figure is derived from the inputs above, so it updates whenever they do.
It never leaves the tab. The page does the work itself rather than asking a server to.
No. There is no account, no usage cap and no trial period. The site is funded by advertising rather than by charging for the tools.
It implements the published definition directly, without shortcuts or approximations.