Is this the same as the JWT Builder tool?

No. The JWT Builder takes a payload and a secret you provide, and builds and signs a full token from them. This tool does one narrower thing: it generates a strong random secret key you could then paste into the JWT Builder (or your own server code) to actually sign tokens with.

Why is the secret a different length for HS256 vs. HS512?

RFC 7518 (JSON Web Algorithms) recommends an HMAC key be at least as long as the hash function's output size, so the signature can't be trivially weaker than the hash itself. HS256 uses SHA-256 (32-byte output), HS384 uses SHA-384 (48 bytes), and HS512 uses SHA-512 (64 bytes), so this tool matches the generated secret's length to whichever algorithm you pick.

Why offer both hex and base64 output?

Different libraries and config formats expect different encodings, some JWT libraries or environment variable conventions expect a hex string, others expect base64 (or base64url). Providing both means you can paste whichever format your specific setup needs without a separate conversion step.

Is a secret generated in the browser safe to use in production?

The randomness itself comes from the Web Crypto API's crypto.getRandomValues, a cryptographically secure source, the same one browsers use for real security-sensitive operations. That said, treat any value that passed through a browser tab with the same caution you'd apply to any freshly generated secret: store it in a proper secrets manager or environment variable, never commit it to source control, and rotate it if you suspect exposure.

JWT Secret Generator - HS256/HS384/HS512 Key Generator

Overview

Introduction

Picking a JWT HMAC secret by typing a memorable password is a common mistake, HMAC signing needs a genuinely random key at least as long as the hash function's output, not a human-chosen string.

This tool generates exactly that: a cryptographically random secret sized correctly for HS256, HS384, or HS512, ready to use as an actual JWT signing key.

What Is JWT Secret Generator?

A secret key generator for JWT's HMAC-based signing algorithms (HS256, HS384, HS512), using the Web Crypto API's crypto.getRandomValues to produce genuinely random bytes, not a password generator or passphrase tool.

The output is the same random bytes shown in two encodings, hex and base64, so you can use whichever your JWT library or config format expects.

How JWT Secret Generator Works

Selecting an algorithm sets the generated secret's byte length to match RFC 7518's recommendation, 32 bytes for HS256, 48 for HS384, 64 for HS512, then `crypto.getRandomValues()` fills that many bytes with cryptographically secure random data.

Those raw bytes are then encoded twice, once as a hex string (each byte as two hex characters) and once as standard base64, both representing the exact same underlying secret.

When To Use JWT Secret Generator

Use it whenever you're setting up a new service that signs JWTs with HMAC and need a properly-sized random secret, rather than typing one by hand.

It's also useful for rotating an existing weak or too-short JWT secret to one that actually meets RFC 7518's minimum length recommendation for your chosen algorithm.

Often used alongside SSH Key Generator Commands.

Features

Advantages

Uses the Web Crypto API's cryptographically secure random source, not Math.random() or another non-cryptographic generator.
Automatically sizes the secret to the specific algorithm's recommended minimum length, removing the guesswork.
Outputs both hex and base64 so you don't need a separate encoding conversion step.

Limitations

Only generates the secret value itself, it doesn't build or sign an actual token, use the JWT Builder tool for that next step.
Only covers the three HMAC-based algorithms (HS256/384/512), not RSA or ECDSA-based JWT signing, which use a key pair rather than a shared secret.

Examples

Generating an HS256 secret

Input

algorithm: HS256

Output

hex: 9f2a1c8e4b7d3f0a6e5c2b1d8a9f4e7c0b3d6a1f2e5c8b9d4a7f0e3c6b1d8a2f
base64: nyocjkt9Pwpu...

32 random bytes are generated (matching SHA-256's output size) and shown as both a 64-character hex string and its base64 equivalent.

Best Practices & Notes

Best Practices

Store the generated secret in an environment variable or dedicated secrets manager, never hardcode it directly in source code or commit it to version control.
Generate a new secret per environment (development, staging, production) rather than reusing one everywhere, limiting the blast radius if one environment's secret leaks.
Rotate the secret periodically, and immediately if you suspect it was ever exposed, keeping in mind that rotation invalidates every previously issued token signed with the old secret.

Developer Notes

Byte length is chosen per algorithm to satisfy RFC 7518 §3.2's recommendation that an HMAC key's length be at least equal to the hash output size (32/48/64 bytes for SHA-256/384/512 respectively); `crypto.getRandomValues()` fills a same-sized Uint8Array, which is then encoded once as lowercase hex and once as standard (non-URL-safe) base64 via the same byte-chunking approach used elsewhere in this app's PEM export code.

JWT Secret Generator Use Cases

Generating a properly-sized JWT signing secret for a new service using HMAC-based tokens
Rotating an existing, under-length JWT secret to meet RFC 7518's recommended minimum length
Producing a quick test secret for use with this app's JWT Builder or JWT Debugger tools

Common Mistakes

Using a short, human-memorable password as an HMAC secret instead of a full-length random value, weakening the signature far below the hash algorithm's real security margin.
Reusing the exact same secret across development, staging, and production environments, so a leak in one compromises all of them.

Tips

Paste the generated secret straight into this app's JWT Builder tool to actually build and sign a test token with it.

JWT Secret Generator