DEV Community: chubiao huang (MR HUANG)

How to Generate a Secure JWT Secret Key in 2026 (Node.js, Python, Java)

chubiao huang (MR HUANG) — Thu, 15 Oct 2026 18:13:13 +0000

A JSON Web Token (JWT) is only as strong as the secret key that signs it. Yet the single most common JWT vulnerability in production is still a weak, hardcoded, or leaked secret. This guide shows you how to generate a cryptographically secure JWT secret key, how long it should be, and how to use it correctly in Node.js, Python, and Java.

What is a JWT secret key?

A JWT secret key is a private, random string used to sign a JSON Web Token. The signature is what proves two things:

The token was issued by your server (not forged by an attacker).
The token's payload has not been modified since it was signed.

When you use a symmetric algorithm such as HS256, the same secret is used both to sign and to verify tokens. If an attacker learns your secret, they can mint valid tokens for any user — a full authentication bypass. That is why the secret must be long, random, and private.

How long should a JWT secret be?

Match the key length to the signing algorithm:

Algorithm	Minimum secret length	Recommended
HS256	256 bits (32 bytes)	32–64 bytes
HS384	384 bits (48 bytes)	48–64 bytes
HS512	512 bits (64 bytes)	64 bytes

A secret that is too short (or a human-memorable passphrase) can be brute-forced offline. Because the attacker has the signed token, they can guess secrets locally as fast as their hardware allows — there is no rate limit. Use a cryptographically secure random generator, never Math.random(), never a password you made up.

How to generate a secure JWT secret key

The safest and fastest way is a generator that runs entirely in your browser and never sends the key anywhere:

👉 JWT Secret Key Generator — jwtsecrets.com — generates a cryptographically strong key with one click, supports 32–512 bits, and never transmits or stores your key.

If you prefer the command line or your own code, here are the correct ways to do it in each language.

Node.js

node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"

Or in code:

const crypto = require('crypto');
const secret = crypto.randomBytes(64).toString('hex'); // 128 hex chars = 512 bits

Python

import secrets
secret = secrets.token_hex(64)  # 128 hex chars = 512 bits
print(secret)

secrets is the CSPRNG-backed module — never use random for this.

OpenSSL (any OS, one-liner)

openssl rand -base64 64

Java

import java.security.SecureRandom;
import java.util.Base64;

byte[] bytes = new byte[64];
new SecureRandom().nextBytes(bytes);
String secret = Base64.getEncoder().encodeToString(bytes);

Using the secret in your application

Node.js with `jsonwebtoken`

require('dotenv').config();
const jwt = require('jsonwebtoken');

const secret = process.env.JWT_SECRET; // from your .env, never hardcoded

// Sign
const token = jwt.sign({ sub: user.id }, secret, { expiresIn: '15m' });

// Verify
try {
  const payload = jwt.verify(token, secret);
} catch (err) {
  // invalid or expired token
}

Python with PyJWT

import os, jwt

secret = os.environ["JWT_SECRET"]

token = jwt.encode({"sub": user_id}, secret, algorithm="HS256")
payload = jwt.decode(token, secret, algorithms=["HS256"])

Three mistakes that leak your JWT secret

Hardcoding the secret in source control. Once a secret is committed, assume it is public — even if you delete it later, it lives on in git history and forks. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, Google Secret Manager, HashiCorp Vault).
Reusing one secret everywhere. Use a different secret per environment (dev / staging / prod) and per service. A leak in one place should not compromise everything.
Never rotating. Rotate your signing secret on a schedule and immediately after any suspected exposure. Plan for rotation so old tokens can expire gracefully.

Symmetric secret vs. asymmetric key: which do you need?

Symmetric secret (HS256): one shared key signs and verifies. Simplest. Best when a single service issues and verifies its own tokens.
Asymmetric key (RS256 / ES256): a private key signs, a public key verifies. Use this when multiple services or third parties must verify tokens without being able to create them — for example, an auth service issuing tokens that many microservices consume.

If you need RSA or EC keys instead of a symmetric secret, generate a key pair rather than a shared secret.

FAQ

Is it safe to generate a JWT secret in a browser?
Yes, if the tool generates the key locally with the Web Crypto API and never sends it over the network. The JWT Secret Key Generator does exactly that — you can even disconnect from the internet before generating.

Can I just use a long password as my JWT secret?
You can, but you should not. Passwords have far less entropy per character than random bytes and are vulnerable to dictionary attacks. Always use a CSPRNG.

What happens if my JWT secret leaks?
Anyone with the secret can forge tokens for any user. Mitigate immediately: rotate the secret (which invalidates existing tokens), and consider a token revocation/denylist while the new secret propagates.

A strong JWT secret is a two-minute task that prevents a whole class of authentication vulnerabilities. Generate one with a CSPRNG, keep it out of source control, and rotate it on schedule.

Generate your JWT secret key now → jwtsecrets.com

Also useful: JWT Decoder to inspect any token's header and payload.

Why Everyone's Suddenly Measuring Their Face Instead of Filtering It

chubiao huang (MR HUANG) — Tue, 11 Aug 2026 07:40:10 +0000

There's a moment a lot of people know. You catch your reflection in a dark phone screen, or you see yourself in a video call thumbnail at some angle you never chose, and you think: wait, is that actually what I look like?

For years the only answer was a filter. Smooth the skin, widen the eyes, narrow the jaw, post it, move on. It felt good for a second and told you nothing real.

That's changed this year. The tools people reach for now aren't filters. They're measurement tools. And I think the shift says less about vanity than about a plain question a lot of us have: I don't just want to look better in a photo, I want to know what I'm actually working with.

From Filters to Real Data

The filter era was built on distortion — stretch this, blur that, guess at "attractive." It never told you anything you could actually use.

What's replacing it looks more like biometrics than Instagram. AI face analysis tools now use the same landmark-detection tech that shows up in medical imaging and computer vision research, just pointed at a more personal question: how symmetrical is this face, really? Where do the proportions sit against known ratios? What's the actual geometry, not the flattering version of it?

This is basically the engine behind looksmaxxing tools — a term that started in fringe forums and has since become normal shorthand for using data instead of guesswork to understand your own face. Search interest in things like "facial symmetry test" and "golden ratio face calculator" has been climbing for a while, and I don't think it's because people got shallower. It's because now there's something to search for that gives you a real answer.

How These Tools Actually Work

I'll use FaceRated here, mostly because it's the clearest example of where this whole category is heading — a face rating tool that's become a kind of reference point for how mature the tech has gotten.

You upload a photo — except you don't really "upload" it. The image never leaves your device. FaceRated maps 478 individual points across your face directly in your browser, the same kind of dense landmark mesh used in facial-recognition research, and runs the whole analysis locally. No server round trip, no account, no email address.

In about three seconds you get a beauty score from 0 to 100, plus a breakdown of the geometry behind it. That speed matters — this isn't a multi-step signup flow, it's closer to a mirror that happens to do math.

If you want more, a one-time report unlocks 40+ additional measurements, a 3D reconstruction of your face mesh, and a plain-language rundown of what's structural versus what's actually adjustable. But the free version isn't a stripped-down teaser to bait you into paying — it's a complete first look on its own, which is rarer in this space than it should be.

What the Six Dimensions Actually Tell You

This is the part that stops feeling like a party trick.

Instead of one vague number, the analysis breaks into six dimensions: symmetry, adherence to golden ratio proportions, jawline definition, canthal tilt (the angle of your eyes relative to horizontal), facial thirds (the vertical balance between forehead, midface, and lower face), and eyebrow position relative to the eye socket.

Here's what mine looked like when I ran it on a lunch break, out of curiosity more than anything: strong facial thirds, a slightly negative canthal tilt, and a jawline score lower than I expected — not because anything was "wrong," but because my jaw angle sits a bit wider than the reference range it compares against. It also flagged mild asymmetry between my left and right brow height, which I genuinely hadn't noticed until it was pointed out, and now can't unsee in old photos.

None of that felt like an insult, honestly. It felt like the kind of thing an orthodontist or a portrait photographer has always been able to see, just handed to a regular person for once. A facial symmetry test used to mean calipers and someone else's professional opinion. Now it's a free scan on your phone.

Why "It Never Leaves Your Device" Matters

Faces are about as sensitive as personal data gets. A face photo sitting on someone's server tied to your account is a very different risk from a face photo that gets analyzed in your browser tab and disappears the moment you close it.

This is probably the most important design decision in the whole category, and it's the one a lot of competitors have been slower to take seriously. Plenty of earlier tools here — things like thefacereport, facewow, moggedup — do one job fine, whether that's a quick score or a symmetry overlay, but most still send your photo through a server, and few make privacy the headline instead of a line buried in the terms of service.

FaceRated's approach — no upload, no account, nothing stored, everything processed on-device — treats privacy as the baseline instead of a paid add-on. When you're using an AI face analysis free tool on your own face, "where does this photo actually go" shouldn't be something you have to dig for.

What's Next: Beyond the Face

The more interesting part isn't the face score itself, it's what's getting bolted onto it. FaceRated has started adding body analysis using the same on-device model, plus a set of cosmetic procedure calculators that let someone explore what a change to their jawline or brow might look like before they ever sit in a consultation room.

It's also rolling out in Brazilian Portuguese and Simplified Chinese alongside English, which matters more than it sounds. A lot of this kind of tech got built and tested mostly on English-speaking, Western datasets and audiences. Bringing the same private, on-device tools to more languages is a sign the category is growing past its novelty-app phase into something more like a real utility.

Where it's heading is pretty clear: one platform covering face, body, and cosmetic planning, instead of five separate single-purpose apps, none of it requiring you to hand a photo to someone else's server.

Try It Yourself

You don't need to decide in advance whether you care about your canthal tilt. Point a camera at yourself, wait three seconds, see what the geometry actually says — free, private, nothing saved anywhere.

That's basically the whole trend in one sentence: less filtering, more measuring. Less "how do I look," more "here's what's actually there."

Try FaceRated for free → facerated.com

Why Use Our Free Online UUID Generator?

chubiao huang (MR HUANG) — Sat, 13 Sep 2025 16:11:12 +0000

✅ Instant uuid generation (uuid4, uuid v1, uuid v5)
✅ Works across JavaScript, Python, Node.js, Java, C#, Golang
✅ Supports random uuid, guid, and universal unique identifier generation
✅ No installation required – generate uuid online easily
✅ Uses secure Web Crypto API for randomness (uuid4)
FAQ about UUIDs and GUIDs
What is a uuid? A universally unique identifier (UUID) is a 128-bit string that helps identify information uniquely without coordination.
What is a guid? GUID (Globally Unique Identifier) is Microsoft's term for UUID; functionally, they are the same.
How do I generate uuid online? Use this tool to instantly get uuid4, uuid v1 or uuid v5 online, copy and use anywhere.
Is uuid secure? UUID v4 is based on random numbers, using secure crypto sources; uuid v1 uses timestamp + MAC, so avoid exposing sensitive info.
Can I use uuid in databases? Yes! PostgreSQL uuid, Java uuid, Node js uuid, and more are widely used as primary keys.