JWT Secret Generator (HS256 / HS384 / HS512)

At least 256 bits (32 bytes) for HS256 and 512 bits (64 bytes) for HS512 — RFC 7518 requires a key at least as long as the hash output. This page generates exactly that. A human-chosen string like mysecretkey123 has a tiny fraction of that entropy.

HS256 with a random 256-bit key is not a practical weak point — pick HS512 only for policy reasons or because the rest of your stack is on SHA-512. The more useful question is symmetric versus asymmetric: if tokens are verified by several services, use RS256 or EdDSA instead, so verifiers never hold the key that can also sign.

Anyone holding one of your tokens can brute-force the secret offline on a GPU, then forge tokens with any claims they like — including admin. This is a routine attack, not a theoretical one, and it is silent: nothing in your logs shows it happening. A full-entropy random key removes the attack entirely.

That .NET error means your signing key is shorter than HS256 requires — paste the HS256 value above into your configuration. The full explanation, including why .NET measures UTF-8 bytes so a short passphrase fails even when it looks complicated, is on our guide: how long should a JWT secret be.