KeyGen
All ToolsClient-Side Utility

JWT Secret Generator

Generate secrets for JSON Web Token (JWT) signing and verification

Configuration

Most commonly used, 32+ bytes recommended

Usage Example (Node.js)

const jwt = require('jsonwebtoken');

const secret = 'YOUR_JWT_SECRET_HERE';

// Create token
const token = jwt.sign(
  { userId: 123, role: 'user' },
  secret,
  { algorithm: 'HS256', expiresIn: '24h' }
);

// Verify token
const decoded = jwt.verify(token, secret);
console.log(decoded);

JWT Secret Best Practices

  • • Store the secret in environment variables, never commit to version control
  • • Use a secret that's at least 32 bytes (256 bits) long
  • • Use different secrets for different environments (dev, staging, production)
  • • Rotate secrets periodically (every 90–180 days)
  • • Never expose the secret in logs or error messages
  • • Use HTTPS to prevent token interception
  • • Include expiration times in tokens (expiresIn: '24h')
  • • Validate token signatures before trusting claims

HMAC Algorithms

HS256 (SHA-256)

Most widely used, suitable for most applications

HS384 (SHA-384)

Increased security, slower than HS256

HS512 (SHA-512)

Maximum security with HMAC, slowest option