128-Character Random String JWT Secret Generator
This 128-character secret is sampled uniformly from a 74-symbol alphabet covering uppercase, lowercase, digits, and common punctuation. It's the best choice when a human will read, transcribe, or paste the value into a UI that rejects Base64's '+' and '/' characters. At 128 characters it supplies roughly 794 bits of entropy, positioning it in the "generous" tier for HMAC-based JWT signing (HS384 / HS512).
Generating…
Why 128 characters?
128 characters is a deliberately generous size: teams pick it when the secret must survive years of rotation policy without ever being the weakest link in the auth chain, and when HS512 is in play.
Storage & performance: Exceeds the 64-byte SHA-256 block size, which means HMAC first hashes the key down to 32 bytes before use — a one-time, sub-microsecond cost that's irrelevant outside extremely hot signing loops.
Random strings are used verbatim as the HMAC key material — no decoding step, which makes them the simplest format to reason about in any language.
When to use / when to avoid
Use a 128-char Random String secret when…
- You're signing tokens with HS512 and want a key sized to match its output.
- Compliance or a security audit calls for 'at least 1024 bits' of key material.
- The secret is long-lived (multi-year rotation window) and needs extra margin.
Consider a different length when…
- Overkill for a quick local prototype where a 32-char secret would do.
- Unnecessary if your platform truncates env vars below this length.
Generate a 128-char Random String secret in code
Each snippet below produces the same shape of secret as the tool above: a 128-character random string string using each language's cryptographically secure RNG.
import crypto from "node:crypto"; const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~!@#$%^&*"; const bytes = crypto.randomBytes(128); let secret = ""; for (let i = 0; i < 128; i++) secret += alphabet[bytes[i] % alphabet.length]; console.log(secret); // 128-char random string
import secrets
alphabet = (
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~!@#$%^&*"
)
secret = "".join(secrets.choice(alphabet) for _ in range(128))
print(secret) # 128-char random stringpackage main
import (
"crypto/rand"
"fmt"
"math/big"
)
const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~!@#$%^&*"
func main() {
out := make([]byte, 128)
for i := range out {
n, _ := rand.Int(rand.Reader, big.NewInt(int64(len(alphabet))))
out[i] = alphabet[n.Int64()]
}
fmt.Println(string(out)) // 128-char random string
}import java.security.SecureRandom;
String alphabet =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~!@#$%^&*";
SecureRandom random = new SecureRandom();
StringBuilder sb = new StringBuilder(128);
for (int i = 0; i < 128; i++) {
sb.append(alphabet.charAt(random.nextInt(alphabet.length())));
}
String secret = sb.toString();
System.out.println(secret); // 128-char random stringSecurity notes
- Generated locally with crypto.getRandomValues — nothing is sent to a server, logged, or cached.
- Regenerate before first use in production; treat any secret shown on shared screens as compromised.
- Store it in a secrets manager or git-ignored .env file, never in source control or client-side code.
- Rotate on a schedule and support at least one overlapping "next" secret to allow zero-downtime rotation.
FAQ
Why does this generator produce 128-character Random String strings specifically?
128 characters is a deliberately generous size: teams pick it when the secret must survive years of rotation policy without ever being the weakest link in the auth chain, and when HS512 is in play. The exact length is fixed at 128 so the output is deterministic to copy into configuration without manual trimming.
How many bits of entropy does a 128-character Random String secret carry?
A–Z, a–z, 0–9, and common symbols (74-symbol alphabet) yields about 6.2 bits per character, so 128 characters work out to roughly 794 bits of entropy — well above the 256-bit floor commonly cited for HMAC-SHA256 keys.
Which JWT algorithm should I pair with a 128-char Random String secret?
HS384 / HS512. Comfortably covers HS512's 512-bit output while remaining short enough to paste into most secret managers without truncation issues.
Random String vs. other formats at 128 characters — which should I pick?
Cryptographically random alphanumeric + symbol characters drawn from a 74-character alphabet (~6.2 bits/char). Random strings are used verbatim as the HMAC key material — no decoding step, which makes them the simplest format to reason about in any language. Pick a different format only if your framework or secrets manager has a stated preference.
Does the 128-character length affect signing or verification performance?
Exceeds the 64-byte SHA-256 block size, which means HMAC first hashes the key down to 32 bytes before use — a one-time, sub-microsecond cost that's irrelevant outside extremely hot signing loops.
Where should I store a 128-character Random String JWT secret?
Use a secrets manager (Doppler, AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, 1Password) or a git-ignored .env file. Never commit it to source control, and rotate it on a schedule appropriate for HS384 / HS512.
Is this 128-char Random String secret generated securely?
Yes — it's produced entirely in your browser with the Web Crypto API's crypto.getRandomValues, a cryptographically secure PRNG. No network request is made and the value is never transmitted or logged.
Can I reuse this Random String secret for something other than JWTs?
Yes. A 128-character Random String string is a general-purpose high-entropy secret — it also works as an API key, session-encryption key, or CSRF token secret needing around 794 bits of randomness.
Related generators & tools
Recent articles
Guides on JWT secrets, signing algorithms, and token security.