Generate cryptographically secure secrets for JWT_SECRET, JWT_REFRESH_SECRET, AUTH_SECRET (NextAuth), WEBHOOK_ENCRYPTION_KEY, and SESSION_SECRET. Hex, Base64, Base64url output. Equivalent to openssl rand -hex 32.
Free, no sign-up — one of the SaaSQuickStart Privacy & Security tools.
HMAC-SHA256 has a 256-bit internal state, so a 256-bit key fully saturates it — there is no security gain from going larger for HMAC-SHA256. For HMAC-SHA512 (used in HS512 JWTs), 512 bits is optimal. Below 128 bits is never acceptable.
Hex is the most portable format — no special characters, no padding issues. It is what openssl rand -hex produces and what most JWT libraries accept as-is. Base64 also works but occasionally causes issues with `=` padding in shell scripts or certain config parsers.
Using separate secrets means a compromised access secret does not expose refresh tokens (and vice versa). An attacker who steals JWT_ACCESS_SECRET can forge short-lived tokens but cannot forge the long-lived refresh tokens needed to get new access tokens. Always rotate both independently.
NextAuth.js and Auth.js expect a Base64url string for their AUTH_SECRET. Base64url avoids + and / characters which can break URL parsing, and omits = padding which can confuse some config systems.
Yes — this tool uses the Web Crypto API (crypto.getRandomValues), which is the same CSPRNG your OS uses. It is cryptographically secure and does not rely on Math.random(). The secrets are never sent to any server — check the network tab to verify.