Generate a JWT signing secret
A random key for JSON Web Tokens signed with HMAC: 256 bits for HS256, 384 for HS384 and 512 for HS512, the minimum sizes RFC 7518 sets for each algorithm.
Runs in your browser. Nothing you type is sent anywhere.
The tool is code on this page. It makes no network requests while you use it, stores nothing in cookies or local storage, and keeps working if you go offline after the page loads.
Secret key generator: JWT
Runs in your browser
Secret
.env line
At a glance
- Variable
- No standard name, for example JWT_SECRET
- Format
- Random bytes in Base64: 32, 48 or 64 bytes
- Randomness
- 256 bits, 384 bits, 512 bits
- Requirement
- RFC 7518 §3.2: a key at least the size of the hash output
Some libraries decode a Base64 secret into bytes; others use the text as it is. Both are fine for strength, because the 44-character Base64 text of 32 random bytes carries all 256 bits either way. Just make sure every service reads the key the same way, or signatures won't match.
The same without a browser
openssl rand -base64 32openssl rand -base64 48openssl rand -base64 64 | tr -d '\n'What the secret protects
With HS256, HS384 and HS512 the same secret both signs and verifies tokens. Anyone who holds it can mint a valid token for any user, so every service that checks tokens also holds a key that can create them. If some verifiers run in places you trust less than the service that issues tokens, an asymmetric algorithm such as RS256 or EdDSA gives verifiers only a public key.
What breaks when you change it
Every token signed with the old secret fails verification at once. Access tokens are rejected, refresh tokens stop working, and everyone has to sign in again.
Changing it without signing everyone out
Give each key an ID and put it in the token's kid header. Sign new tokens with the new key, keep accepting the old key for verification until the longest-lived token signed with it has expired, then remove it. Check that your JWT library can look up verification keys by kid.
How Crunu handles this
A separate value for every environment
In Crunu each environment has its own key, sealed separately to each person and machine allowed to read it, so a value generated for staging never travels with production. When you add a variable, Generate in the editor fills it with 40 random letters and digits right in the environment's table, so the value goes into the encrypted environment instead of through a clipboard and a chat window. The server stores values only as ciphertext.
Read about the vaultQuestions about this tool
Found a case the tool gets wrong? Write to support@crunu.com
How long should an HS256 secret be?
At least 256 bits, which is 32 random bytes. RFC 7518 requires a key at least the size of the hash output: 256 bits for HS256, 384 for HS384 and 512 for HS512. A short password-like string is not enough, because tokens can be attacked offline.
Should I use HS512 instead of HS256?
HS256 with a 256-bit random key is already far beyond guessing. Choose the algorithm your stack supports and use a key of the matching size; the size matters more than the algorithm name.
Can I use the same secret in two services?
Only if both are meant to issue tokens for each other. Otherwise give each issuer its own key, or move to an asymmetric algorithm so services that only verify never hold a signing key.
Read more
Other free tools
- .env linterFinds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- .env converterTurns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Compare two .env filesShows which variables exist in only one file and which have different values, with values hidden until you ask.
- OIDC trust policy builderTrust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- Offboarding checklist generatorPick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.