JWT Secret Strength Checker
The JWT Secret Strength Checker evaluates a candidate HMAC signing secret — its length, character diversity and estimated entropy — and rates how resistant it would be to brute-force attacks.
What This Tool Does
HMAC-signed JWTs (HS256/384/512) are only as strong as their secret: a weak secret can be brute-forced offline from a single captured token. Paste a candidate secret and this tool estimates its entropy from length and character classes, then grades it from weak to strong with concrete guidance.
How to Use
- Paste the secret you want to evaluate into the input field (not a token).
- Read the strength rating and entropy estimate.
- Check which character classes the secret uses.
- Strengthen weak secrets with length and randomness, then re-test.
Key Features
- Entropy estimate based on length and character diversity
- Clear strength rating from weak to strong
- Character-class breakdown (lower, upper, digits, symbols)
- Guidance aligned with HMAC key-length recommendations
- Instant re-evaluation as you type
- Secrets never leave your browser
Common Use Cases
- Vetting a new signing secret before deploying it
- Auditing existing secrets after a security review
- Learning why "secret123" is not a secret
- Comparing candidate secrets during key rotation
- Teaching developers about offline brute-force risk
How Long Should an HMAC Secret Be?
Match the key to the hash output: at least 32 bytes for HS256, 48 for HS384 and 64 for HS512. More important than exotic characters is randomness — a long, randomly generated string beats a short, clever one.
Because anyone with a token can attempt unlimited offline guesses, prefer secrets generated by a CSPRNG (for example a password manager or crypto library) over human-chosen phrases.
Frequently Asked Questions
What is entropy in this context?
Entropy estimates how many guesses an attacker would need, derived from the secret’s length and the size of its character set. Higher entropy means harder brute-forcing.
Is my secret safe to paste here?
The analysis runs entirely in your browser — nothing is transmitted or stored. Still, avoid testing production secrets on shared machines.
What makes a JWT secret strong?
Length and randomness. Use at least 32 random bytes for HS256 (48 for HS384, 64 for HS512), ideally generated by a cryptographically secure random generator.
Can a strong-looking password still be weak?
Yes. Human-chosen strings have far less real entropy than their length suggests because attackers try common patterns first.
Does this apply to RS256 keys?
No — asymmetric algorithms use key pairs with their own strength parameters. This checker targets HMAC shared secrets.
What happens if my secret is weak?
An attacker who captures one token can brute-force the secret offline and then forge valid tokens. Rotate to a strong random secret immediately.
Related JWT Tools
- JWT Signature Verifier — Verify JWT signature with secret or public key
- JWT Header Viewer — Display JWT header information only
- JWT Decoder — Decode JWT tokens to view header and payload
- JWT Inspector — Comprehensive analysis of JWT token structure and claims