May 12, 2026 · 6 min

Generate a Secure JWT Secret (2026)

A practical guide to creating cryptographically secure JWT secrets for HS256, HS384, and HS512 — with code examples in Node.js, Python, and the browser.

Why your JWT secret matters The JWT secret is the only thing standing between an attacker and the ability to forge tokens for any user in your system. A weak or predictable secret is one of the most common — and most catastrophic — auth misconfigurations.

Minimum length by algorithm - HS256 — 256 bits (32 bytes) minimum - HS384 — 384 bits (48 bytes) - HS512 — 512 bits (64 bytes)

Generate from a CSPRNG, never a passphrase Use a cryptographically secure pseudo-random number generator. In Node: `crypto.randomBytes(64).toString('base64')`. In the browser: `crypto.getRandomValues()`. Both are exposed by this tool's generator.

Rotate on a schedule Plan for rotation from day one. Use a key-id (`kid`) header so multiple secrets can be valid during a rollover window.

Generate a JWT secret now

Related tools and reading