Frequently Asked Questions
Everything developers ask about JWT secrets and authentication.
What is a JWT?+
JSON Web Token is a compact, URL-safe token format (RFC 7519) used to transmit signed claims between parties. It consists of three Base64URL-encoded segments: header, payload, and signature.
What is a JWT secret?+
The JWT secret is the symmetric key used by HMAC algorithms (HS256/HS384/HS512) to sign and verify tokens. Anyone holding it can issue valid tokens, so it must stay private.
What length should my JWT secret be?+
At minimum match the algorithm's output size: 256 bits (32 bytes) for HS256, 384 bits for HS384, 512 bits for HS512. Longer is fine; shorter weakens signing security.
Is this generator safe to use?+
Yes. Every secret is produced locally in your browser using the Web Crypto API (crypto.getRandomValues). Nothing is transmitted, logged, or stored on any server.
How often should I rotate JWT secrets?+
Rotate on a schedule (every 90 days is common) and immediately if compromise is suspected. Use a JWKS endpoint or key-id (kid) header so tokens signed under old keys remain verifiable during the rollover.
JWT vs session cookies — which should I use?+
Sessions are simpler and easier to revoke. JWTs scale well for stateless APIs and microservices. Many production systems use both: short-lived JWT access tokens plus server-side refresh sessions.
What is HS256?+
HMAC-SHA256 — a symmetric JWT signing algorithm that uses a shared secret. Fast and simple, but the same key signs and verifies, so every verifier must be trusted.
What is RS256?+
RSA Signature with SHA-256 — an asymmetric algorithm. The private key signs, the public key verifies. Preferred when verifiers should not be able to issue tokens.
Can a JWT be hacked?+
JWTs themselves are tamper-evident, but implementations are routinely attacked: weak HS256 secrets brute-forced offline, the 'none' algorithm bypass, algorithm-confusion (RS256 → HS256), and leaked secrets in source control.
Can I use a passphrase as my JWT secret?+
No. Passphrases have far less entropy than random bytes and are crackable offline. Always generate from a CSPRNG — that is exactly what this tool does.
What is a refresh token?+
A long-lived token (often opaque, stored server-side) used to obtain new short-lived access tokens without requiring the user to re-authenticate.
Where should I store the JWT secret?+
In a secrets manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault) or environment variables managed by your platform. Never commit it to git.