[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"tools-page-secret-key-generator\u002Fjwt-secret":3},{"page":4,"related":67,"variants":86},{"path":5,"name":6,"title":7,"description":8,"checkedAt":9,"sources":10,"faq":20,"related":33,"nuxter":37,"body":40,"tool":65,"preset":66},"\u002Ftools\u002Fsecret-key-generator\u002Fjwt-secret","JWT secret","JWT Secret Generator for HS256 and HS512","Generate a JWT signing secret in your browser, 256 bits for HS256 or 512 bits for HS512 as RFC 7518 requires, as base64url, base64 or hex.","2026-10-06",[11,14,17],{"label":12,"url":13},"RFC 7518, section 3.2, HMAC with SHA-2 functions","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7518#section-3.2",{"label":15,"url":16},"Cloudflare Workers docs, Secrets","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fworkers\u002Fconfiguration\u002Fsecrets\u002F",{"label":18,"url":19},"MDN, Crypto.getRandomValues()","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FAPI\u002FCrypto\u002FgetRandomValues",[21,24,27,30],{"question":22,"answer":23},"How long should a JWT secret be?","At least as long as the hash. RFC 7518 requires a key of 256 bits or more for HS256, 384 for HS384 and 512 for HS512. In bytes that is 32, 48 and 64.",{"question":25,"answer":26},"Should I use a JWT secret or a key pair?","A shared secret with HS256 suits one service that both signs and checks its tokens. When other services check tokens they must not be able to sign, use a key pair with RS256 or ES256 instead.",{"question":28,"answer":29},"Which encoding should I use?","base64url is the safe default, since JWTs use it too and it needs no escaping. Make sure your library decodes the secret the same way, or it will use the text itself as the key.",{"question":31,"answer":32},"How do I store a JWT secret on Cloudflare Workers?","Run npx wrangler secret put JWT_SECRET and paste the value at the prompt. Read it in your Worker from the env binding, never from code.",[34,35,36],"webhook-signature-verifier","nuxt-environment-variables","uuid-v7-generator",{"body":38,"to":39},"Nuxter keeps sessions in sealed cookies through nuxt-auth-utils, so a SaaS built on it needs no JWT secret for sign-in. Reach for one when you add an API that issues its own tokens.","\u002Ffeatures",{"type":41,"value":42,"toc":59},"minimark",[43,48,52,56],[44,45,47],"h2",{"id":46},"the-rule-in-rfc-7518","The rule in RFC 7518",[49,50,51],"p",{},"Section 3.2 says a key of the same size as the hash output, or larger, must be used. A short secret weakens HS256 no matter how good SHA-256 is, because guessing the key is cheaper than breaking the hash.",[44,53,55],{"id":54},"text-or-bytes","Text or bytes",[49,57,58],{},"Some libraries decode the secret before signing and some use the text itself as the key. Read as text, 43 base64url characters make a 43-byte key that still carries 256 bits of randomness, so either reading is safe. The trap is short hex: 32 hex characters pass a 32-byte check as text but hold only 128 bits. The readout above the secret shows characters and bits side by side, so you can size it for either.",{"title":60,"searchDepth":61,"depth":61,"links":62},"",2,[63,64],{"id":46,"depth":61,"text":47},{"id":54,"depth":61,"text":55},"secret-key-generator","jwt-secret",[68,74,80],{"path":69,"tool":34,"name":70,"title":71,"description":72,"summary":73,"checkedAt":9},"\u002Ftools\u002Fwebhook-signature-verifier","Webhook signature verifier","Webhook Signature Verification for Stripe and Polar","Webhook signature verification in your browser for Stripe, Polar, Standard Webhooks, Lemon Squeezy, Creem, Paddle and GitHub, with the reason a check fails.","Check a Stripe, Polar, Lemon Squeezy, Creem, Paddle or GitHub signature in the browser, and see why it fails.",{"path":75,"tool":35,"name":76,"title":77,"description":78,"summary":79,"checkedAt":9},"\u002Ftools\u002Fnuxt-environment-variables","Nuxt environment variables","Nuxt Environment Variables: runtimeConfig to NUXT_","Paste a nuxt.config to get the Nuxt environment variables that override each runtimeConfig key, the type each value arrives as and the names that collide.","Paste a nuxt.config and get the NUXT_ variable for every runtimeConfig key, the type it arrives as and the names that collide.",{"path":81,"tool":36,"name":82,"title":83,"description":84,"summary":85,"checkedAt":9},"\u002Ftools\u002Fuuid-v7-generator","UUID v7 generator","UUID v7 Generator and Decoder, with ULID and NanoID","A UUID v7 generator and decoder for RFC 9562 IDs, with ULID, NanoID and UUIDv4 to compare, a monotonic bulk mode, and Postgres 18, Drizzle and D1 code.","Time-ordered IDs with ULID, NanoID and UUIDv4 to compare, a decoder, and Postgres, Drizzle and D1 code.",[87,90,93,94],{"path":88,"name":89},"\u002Ftools\u002Fsecret-key-generator","Secret key generator",{"path":91,"name":92},"\u002Ftools\u002Fsecret-key-generator\u002Fbetter-auth-secret","BETTER_AUTH_SECRET",{"path":5,"name":6},{"path":95,"name":96},"\u002Ftools\u002Fsecret-key-generator\u002Fnuxt-session-password","NUXT_SESSION_PASSWORD"]