How to generate a secure value for JWT_SECRET

How to Create a High-Strength JWT_SECRET

A secure secret must be long, random, and unpredictable. Simple phrases, dictionary words, or short strings are easily brute-forced or cracked using common tables.

A good secret should be at least 32 bytes long (which results in a longer Base64 string) and generated using a cryptographically secure pseudo-random number generator (CSPRNG).

Generating a Strong Secret

Use your operating system's built-in cryptographic tools to generate the string.

1. On Linux/macOS (Bash): The openssl rand command is a reliable way to generate a strong random string. The -base64 32 flag generates 32 cryptographically random bytes and encodes them in Base64 for safe use in environment files.

   Bash

   openssl rand -base64 32
   

2. On Windows (PowerShell): PowerShell offers a secure way to generate byte arrays using the .NET Framework's RNGCryptoServiceProvider. This ensures the randomness is suitable for cryptographic purposes.

   PowerShell

   $bytes=New-Object Byte[] 32; (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($bytes); [Convert]::ToBase64String($bytes)