DEV Community

Rajesh Kumar Kanumetta
Rajesh Kumar Kanumetta

Posted on

I Built a Free Browser-Only JWT Secret & Key Pair Generator (HMAC + RSA + Ed25519)

#javascript #security #webdev #jwt

If you have ever Googled "JWT secret generator", you already know the problem.

Most tools only spit out a random HMAC string. That is fine for a quick HS256 test, but real apps often need more:

  • RSA / ECDSA / Ed25519 key pairs
  • JWKS export
  • Sign / decode / verify in one place
  • A way to check whether a secret is actually strong enough
  • Rotation guidance that does not live in a random Notion doc

So I built Sealkey.

Live app: https://jwt-secret-key-generator.web.app/

Everything runs in the browser with the Web Crypto API. Your keys never leave your machine.

Why another JWT tool?

I kept bouncing between:

  1. a secret generator site
  2. a JWT debugger
  3. OpenSSL / online RSA generators
  4. Stack Overflow snippets for .env formatting

That is too much friction for something that should take 30 seconds.

Sealkey puts those workflows into one lab:

Need What Sealkey does
Symmetric secrets HS256 / HS384 / HS512 with alphanumeric, enhanced, hex, or Base64URL
Asymmetric keys RS256, ES256, EdDSA (Ed25519) with PEM + JWKS
Debugging Decode, sign, and verify JWTs locally
Strength checks Shannon entropy + strength guidance
Shipping dotenv, bash, PowerShell, Docker, Kubernetes Secret exports
Implementation Snippets for Node, Python, Go, Java, .NET, PHP, Ruby, Rust
Ops Kid-based rotation planner with grace period
Decision help Algorithm advisor for single-service vs microservices

Open the lab here: https://jwt-secret-key-generator.web.app/lab/

Security model (the important part)

Sealkey is intentionally boring on the network side.

  • Key generation uses Web Crypto (crypto.getRandomValues / SubtleCrypto)
  • JWT sign/verify uses jose in the browser
  • No accounts
  • No backend key storage
  • No "send secret to server to analyze it"

If you open DevTools → Network while generating a key, you should not see your secret uploaded anywhere.

That does not mean you can paste secrets into random websites casually forever. It means this tool was designed so generation and inspection stay local.

Still follow production basics:

  • Use at least 256-bit secrets for HMAC in production
  • Prefer asymmetric algorithms when many services verify tokens
  • Store secrets in env vars / a secret manager
  • Never commit secrets to git
  • Rotate on a schedule, and support dual-key verification during cutover

Quick walkthrough

1) Generate an HMAC secret

Open the Lab → Generate → choose bit length (256 is a solid default) → click Generate key.

You get:

  • the secret
  • live entropy analysis
  • copyable exports for .env, shell, Docker, and Kubernetes
  • framework snippets

2) Generate an asymmetric pair

Switch to RSA / EC / Ed25519.

Ed25519 is a great modern default when your stack supports it. RS256 is still the safest "everyone supports this" choice in many enterprise environments.

You get:

  • private PEM
  • public PEM
  • JWKS with a kid

3) Sign / decode / verify

Use the Playground tab to:

  • paste an existing JWT and inspect header/payload
  • sign a payload with a secret or private key
  • verify a signature with a secret or public key

This is especially useful when you are debugging "invalid signature" errors and want a second local opinion.

4) Plan a rotation

The Rotate tab gives a practical checklist:

  1. mint a new key + kid
  2. deploy verifiers that accept old + new
  3. switch issuers to the new key
  4. wait for the grace window
  5. remove the old key

Simple, but teams skip this and then wonder why logouts spike.

Who this is for

  • Backend / fullstack developers setting up auth quickly
  • Teams migrating from HS256 to asymmetric JWT
  • Anyone who wants a private, offline-capable JWT toolkit in the browser
  • Developers who hate juggling five tabs for one secret

Stack

  • Next.js (static export)
  • Tailwind CSS
  • Motion
  • jose
  • Web Crypto API

Hosted on Firebase Hosting:

https://jwt-secret-key-generator.web.app/

Try it and tell me what to add next

If you use Sealkey, I would love feedback on:

  • missing algorithms / formats
  • language snippets you want
  • UX friction in the lab
  • anything that would make key rotation safer for your team

Link again for convenience:

Sealkey: https://jwt-secret-key-generator.web.app/

Built by Kanumetta Rajesh Kumar

Suggested DEV tags

javascript security webdev jwt

Optional extras if you swap tags: opensource showdev nextjs cryptography

Top comments (0)