Question 1

What is a JWT Secret?

Accepted Answer

A JWT secret is a cryptographic key used to sign JSON Web Tokens (JWTs) via HMAC algorithms like HS256. It should be a high-entropy random string.

Question 2

How long should a JWT secret be?

Accepted Answer

For HS256, use at least 32 bytes (256 bits) of random data. The generator produces 64 bytes by default, which exceeds security recommendations.

Question 3

Can I use a passphrase as a JWT secret?

Accepted Answer

No. JWT secrets must be raw random bytes, not human-readable passphrases. Use a dedicated high-entropy random generator.

JWT Secret Generator

Live Example