JWT Secret Generator

Frequently asked questions

How long should an HS256 secret be?

At least 256 bits (32 bytes). RFC 7518, which defines HS256 for JWTs, says the key MUST be at least as long as the SHA-256 output, and RFC 2104 discourages anything shorter because it lowers the security of the HMAC. This tool won't go below 32 bytes. Longer keys are allowed but add little.

hex or base64url — which should I use?

Either is fine cryptographically; it comes down to what your library or config format expects. base64url is more compact for the same number of random bits (useful in an env var or config file); hex is sometimes easier to eyeball or paste into tools that expect raw hex.

Is this secure, or just Math.random()?

It uses the Web Crypto API's getRandomValues — a cryptographically secure random number generator, not Math.random() (which is not safe for secrets or keys).

Is my generated secret stored or sent anywhere?

No — generation happens entirely in your browser tab. Nothing is sent to a server, and the secret is never written to a shareable link.