HMAC · HS256 / HS384 / HS512
JWT Secret Generator
Generate a strong shared secret for signing JSON Web Tokens with HS256, HS384 or HS512 - random bytes from your browser's secure generator.
•••••••••••••••••••••••••••••••••••••••••••
Save this secret securely. Anyone who has it can sign valid tokens. It exists only in this tab: we never send or store it. Keep it in a secret manager or environment variable, never in source control or front-end code.
Generated in your browser with crypto.getRandomValues(). Nothing is sent or stored. Verify it
HMAC Secrets for JWT
JWTs signed with HS256, HS384 or HS512 use HMAC: the same secret both creates and checks the signature. Whoever holds the secret can issue tokens your server will trust, so the secret has to be long, random and kept on the server.
RFC 7518 requires a key at least as large as the hash output: 256 bits (32 bytes) for HS256, 384 bits (48 bytes) for HS384 and 512 bits (64 bytes) for HS512. The tool draws that many bytes from crypto.getRandomValues() and shows which algorithms the length meets. A memorable phrase or a short string typed by hand does not meet the same bar.
HS* versus RS*, ES* and EdDSA
RS256, ES256 and EdDSA work differently: they sign with a private key and verify with a public key from a key pair. Those keys have a mathematical structure and must be created by a crypto library; random bytes from this page are not a valid RSA or elliptic-curve key. Use this generator only for the HS algorithms.
Keeping the Secret Secret
- Server only. Never put the secret in front-end JavaScript or a mobile app; anyone could extract it and mint tokens.
- Not in Git. Load it from an environment variable or a secret manager, and keep it out of committed config files.
- One secret per environment. Development, staging and production should not share a secret.
- Rotate on suspicion. Replacing the secret invalidates every token signed with it, so plan how clients get new tokens.
The secret exists only in this tab. Nothing is sent or stored, and the copy button clears your clipboard after 30 seconds. For general advice on API credentials, see the API key generator.
JWT Secret Generator FAQs
How long should a JWT secret be?
At least as long as the hash output, which RFC 7518 requires: 32 bytes for HS256, 48 for HS384 and 64 for HS512. The default here is 64 bytes, which meets all three.
Can I use this secret with RS256 or ES256?
No. RS256, ES256 and EdDSA are asymmetric: they sign with a private key and verify with a public key, generated as a key pair by your crypto library or a tool such as OpenSSL. This page only makes shared secrets for HS256, HS384 and HS512.
Does my library want the encoded string or the raw bytes?
Many libraries take the secret as a string and use its characters as the key; others expect raw bytes and need you to decode hex or base64 first. Either way the full randomness is kept, and the encoded string is longer than the raw bytes, so it still meets the size rule. Check your library's documentation.
Can this page create or decode JWT tokens?
No, on purpose. It only generates the secret. Signing tokens belongs in your server code, where the secret stays.
Where should I store the secret?
In a secret manager or your platform's protected environment variables - never in front-end JavaScript, never in Git. Anyone with the secret can create tokens your server will accept.
Related guides
CSPRNG vs Math.random(): Why Secure Password Generators Use Web Crypto
