- What makes a good JWT secret key?
- A good JWT secret key should be random, long enough (at least 32 characters), and contain a mix of characters. The key should be kept secure and never shared publicly.
- How long should my JWT secret key be?
- For HMAC-based algorithms (HS256, HS384, HS512), a minimum length of 32 characters is recommended. For better security, use 64 characters or more, especially for HS384 and HS512.
- Can I use special characters in my JWT secret key?
- Yes, you can use special characters in your JWT secret key. In fact, using a mix of uppercase, lowercase, numbers, and special characters increases the key's entropy and security.
- How do I use the generated secret key?
- Copy the generated secret key and use it in your JWT signing process. Keep it secure and never expose it in client-side code or public repositories.
- Is the key generation process secure?
- Yes, keys are generated using cryptographically secure random number generation, entirely in your browser. The keys never leave your device.