Cryptographic Developer Tool

JWT Secret Key Generator

Generate cryptographically secure JWT signing secrets directly in your browser. Engineered with the Web Crypto API for HS256, HS384, and HS512 tokens.

Your secret is generated locally in your browser and is never sent to TryggMontis.
Generated Signing Secret 256 bits • 32 bytes
••••••••••••••••••••••••••••••••••••••••••••••••
Treat this value like a password. Do not commit it to source control or share it publicly.
Generated locally in browser
Uses Web Crypto API
Zero server transmission
No registration required

Technical Specifications

Algorithm HS256 (HMAC with SHA-256)
Key Size 256 bits
Random Bytes 32 bytes (256 bits of entropy)
Encoding Base64URL (RFC 7515 • URL-Safe)
Entropy Engine Web Crypto API (crypto.getRandomValues)
Network Transmission None (100% Client-Side Isolated)

What is a JWT Secret Key?

A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting compact, self-contained claims between a client and a server.

When utilizing symmetric HMAC algorithms—most commonly HS256, HS384, or HS512—both the signing and verification operations rely on a single shared secret key. The authentication server uses this secret to calculate a digital HMAC signature across the token's header and payload. Any application or microservice holding that exact secret can subsequently verify that the payload has not been modified or forged in transit.

Because any entity possessing your JWT secret key can forge valid authentication tokens with arbitrary permissions, generating high-entropy, cryptographically unpredictable keys is vital to your infrastructure's security posture.

JWT Secret Key Sizes & Recommended Minimums

According to RFC 7518 Section 3.2, a key of the same size as the hash output (or larger) MUST be used with each HMAC-SHA algorithm:

Algorithm Hash Function Minimum Required Key Size Cryptographic Bytes Common Use Case
HS256 SHA-256 256 bits 32 bytes Default for web APIs, microservices, mobile apps
HS384 SHA-384 384 bits 48 bytes Higher security compliance & government standards
HS512 SHA-512 512 bits 64 bytes Maximum symmetric entropy & enterprise security

Generating secrets with weak human-memorable passwords (e.g., "secret123" or "my-company-jwt-token") leaves your authentication layer vulnerable to offline dictionary and rainbow-table attacks using modern GPU cracking tools. Always use cryptographically random byte arrays.

How JWT Signing Works

A JWT consists of three parts separated by dots (.): Header, Payload, and Signature.

JWT Token Structure
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYiLCJyb2xlIjoiYWRtaW4ifQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

The signature is calculated by taking the Base64URL-encoded header, concatenating it with the Base64URL-encoded payload, and hashing them using your secret key:

HMAC Signature Formula
HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secretKey
)

If even a single character in the payload is altered, the generated signature will fail verification, causing the server to reject the token immediately.

How to Store & Use Your JWT Secret

Crucial Security Rule: Never hardcode production JWT secrets into your application source code or commit them to version control systems like Git. Store them in protected environment variables or dedicated secret management services (such as AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, or Azure Key Vault).

1. Environment Configuration (.env)

.env
JWT_SECRET=your_generated_base64url_secret_here
JWT_EXPIRES_IN=15m
JWT_ALGORITHM=HS256

2. Node.js (jsonwebtoken)

Node.js / Express
const jwt = require('jsonwebtoken');

// Sign a token
const token = jwt.sign(
  { userId: 'usr_84920', role: 'admin' },
  process.env.JWT_SECRET,
  { algorithm: 'HS256', expiresIn: '1h' }
);

// Verify a token
const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });

3. PHP (firebase/php-jwt)

PHP
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$secretKey = getenv('JWT_SECRET');
$payload = [
  'iss' => 'https://tryggmontis.in',
  'sub' => 'usr_84920',
  'iat' => time(),
  'exp' => time() + 3600
];

// Encode
$jwt = JWT::encode($payload, $secretKey, 'HS256');

// Decode and verify
$decoded = JWT::decode($jwt, new Key($secretKey, 'HS256'));

4. Python (PyJWT)

Python
import os, jwt, datetime

secret_key = os.environ.get('JWT_SECRET')
payload = {
    'user_id': 'usr_84920',
    'exp': datetime.datetime.utcnow() + datetime.timedelta(hours=1)
}

# Encode
token = jwt.encode(payload, secret_key, algorithm='HS256')

# Decode
decoded = jwt.decode(token, secret_key, algorithms=['HS256'])

JWT Security Best Practices

  • Rotate Secrets Periodically: Plan for regular secret rotation. Support key IDs (kid) in token headers so multiple active keys can verify legacy tokens during transition windows.
  • Enforce Short Expiry Windows: Access tokens should have short lifespans (e.g., 5–15 minutes), paired with secure HTTP-only refresh tokens.
  • Explicitly Whitelist Algorithms: Always specify expected algorithms (e.g., algorithms: ['HS256']) on verification to prevent algorithm confusion vulnerabilities (such as the "none" algorithm exploit).
  • Separate Environment Secrets: Never use the same signing secret across development, staging, and production environments.
  • Do Not Store Sensitive Data in Claims: JWT payloads are Base64URL-encoded and easily readable by anyone inspecting the token. Never put unencrypted passwords, credit cards, or PII inside claims.

Frequently Asked Questions

A JWT secret key is a private cryptographic symmetric key used with HMAC algorithms (HS256, HS384, HS512) to calculate and verify token digital signatures. Both the issuer and verifier must possess this shared secret to confirm tokens have not been tampered with.
For HS256, RFC 7518 mandates a minimum key length of 256 bits (32 bytes). Secrets shorter than 256 bits are vulnerable to brute-force attacks. This tool automatically enforces the full 256-bit entropy requirement.
Yes. All secrets are generated entirely in your local browser runtime using the native Web Crypto API (window.crypto.getRandomValues), which draws from the host operating system's cryptographic entropy pool. The secret is never sent across the network, never stored in databases, and never logged.
No. TryggMontis has zero visibility into your generated secrets. There are no AJAX, fetch, or backend API calls involved in generation. The generator operates seamlessly even if you disconnect from the internet after loading the page.
Base64URL is the recommended default for JWT workflows. It replaces URL-sensitive characters (+ and / become - and _) and omits trailing = padding, avoiding escape errors in HTTP headers, cookies, and query strings.
Yes. The generated string is fully standard-compliant and compatible with all major language JWT implementations including jsonwebtoken (Node.js), firebase/php-jwt (PHP), PyJWT (Python), and golang-jwt (Go).