JWT Secret Generator
Generate a cryptographically secure random secret for signing JSON Web Tokens via HMAC-SHA256/384/512.
Security note
Never hardcode this secret in source code. Store it in an environment variable (e.g. JWT_SECRET) and load it at runtime. Rotate secrets immediately if they are ever exposed. Generated locally — never transmitted.
How to choose a JWT signing secret
JSON Web Tokens signed with HMAC (HS256/HS384/HS512) require a shared secret. The security of your tokens depends entirely on the strength of this secret. NIST recommends at least 256 bits of entropy for HMAC-SHA256 keys. This tool generates secrets with crypto.getRandomValues, which draws from your operating system's hardware entropy pool — far stronger than Math.random(). Always use a unique secret per environment (development, staging, production) and never share secrets across services.
Private & free — this tool runs entirely in your browser.