Skip to content
Sign in
Buy Nuxter

Auth

JWT Secret Generator for HS256 and HS512

Generate a JWT signing secret in your browser, 256 bits for HS256 or 512 bits for HS512 as RFC 7518 requires, as base64url, base64 or hex.

  • Runs in your browser

Checked

01Tool

Tool

Encoding
For .env and Wrangler

Characters

43

Entropy

256 bits

Bytes

32

Secrets appear here once the page has loaded.

Same thing from a terminal
node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
Secrets are made in this tab with crypto.getRandomValues. Nothing is sent, stored or put in the address, and they are gone when you leave the page.

02Guide

How it works

The rule in RFC 7518

Section 3.2 says a key of the same size as the hash output, or larger, must be used. A short secret weakens HS256 no matter how good SHA-256 is, because guessing the key is cheaper than breaking the hash.

Text or bytes

Some libraries decode the secret before signing and some use the text itself as the key. Read as text, 43 base64url characters make a 43-byte key that still carries 256 bits of randomness, so either reading is safe. The trap is short hex: 32 hex characters pass a 32-byte check as text but hold only 128 bits. The readout above the secret shows characters and bits side by side, so you can size it for either.

03Questions

Questions

How long should a JWT secret be?
At least as long as the hash. RFC 7518 requires a key of 256 bits or more for HS256, 384 for HS384 and 512 for HS512. In bytes that is 32, 48 and 64.
Should I use a JWT secret or a key pair?
A shared secret with HS256 suits one service that both signs and checks its tokens. When other services check tokens they must not be able to sign, use a key pair with RS256 or ES256 instead.
Which encoding should I use?
base64url is the safe default, since JWTs use it too and it needs no escaping. Make sure your library decodes the secret the same way, or it will use the text itself as the key.
How do I store a JWT secret on Cloudflare Workers?
Run npx wrangler secret put JWT_SECRET and paste the value at the prompt. Read it in your Worker from the env binding, never from code.

04Sources

Sources

Every fact on this page was read from these pages on .

  1. RFC 7518, section 3.2, HMAC with SHA-2 functionsrfc-editor.org/rfc/rfc7518#section-3.2
  2. Cloudflare Workers docs, Secretsdevelopers.cloudflare.com/workers/configuration/secrets/
  3. MDN, Crypto.getRandomValues()developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues

Found something out of date? Tell us.

05Related

Related tools

All tools

Nuxter

Building a SaaS on Nuxt?

Nuxter keeps sessions in sealed cookies through nuxt-auth-utils, so a SaaS built on it needs no JWT secret for sign-in. Reach for one when you add an API that issues its own tokens.

See what Nuxter includesFrom $249, one-time.