The Reality of Modern GPU Brute-Force Attacks
Modern password cracking tools like hashcat can compute hundreds of billions of SHA-256 hashes per second on consumer GPU clusters. If your JWT secret is a 12-character English phrase, an offline attacker with access to a single leaked JWT can extract your secret in minutes.
Frequently Asked Questions
Is a 64-character hex secret sufficient for HS256?
Yes. 64 hexadecimal characters represent 32 bytes (256 bits) of entropy, exactly matching the SHA-256 output size mandated by RFC 7518.