Symmetric Signing (HMAC: HS256, HS384, HS512)
In symmetric signing, the same secret key is used both to sign the token and to verify it. This is fast, simple, and ideal for single-monolith applications or tightly coupled microservices where all services trust the central authority.
Asymmetric Signing (RSA: RS256, ECDSA: ES256, EdDSA)
In asymmetric signing, the identity provider holds a private key to sign tokens, while third-party microservices, clients, or partner APIs verify tokens using a public key (often published via JWKS: JSON Web Key Sets). The verifiers cannot forge new tokens.
Generate in Browser
Launch GeneratorNeed a cryptographically secure JWT secret right now?
Generate 128 to 512-bit keys in Hex or Base64 using Web Crypto with zero server transmission.
Frequently Asked Questions
Can I use this secret generator for RS256?
No! RS256 requires an RSA public/private key pair (e.g., 2048 or 4096-bit RSA PEM format), not a shared symmetric secret string.
Related Technical Guides
JWT Algorithms
HS256 vs RS256: The Real-World Engineering Trade-Offs
Detailed comparison of HS256 and RS256: key distribution, verification speed, authorization boundaries, and security vulnerabilities.
JWT AlgorithmsHS256 Secret Key Requirements: Specifications, Code Examples, and Common Traps
Learn the official RFC 7518 requirements for HS256 JWT keys. Understand key derivation, minimum byte lengths, and implementation examples.