Skip to main content

Secure Your Authentication​

A JSON Web Token (JWT) is only as secure as the secret key used to sign it. If your secret is weak, attackers can forge tokens and gain unauthorized access to your FastAPI application.

Generating...
Entropy Strength: Strong (HS256 Ready)
Choosing the Right Format

Different backend frameworks have different preferences for secret key formats. Use the table below to decide:

FormatBest ForSecurity Note
HEXFastAPI / PythonStandard for HS256. Easy to handle in config files.
Base64Node.js / GoCompact and URL-safe by default.
StringGeneral PurposeIncludes symbols. Highest entropy per character.

How much length do I need?​

JWT signing algorithms have specific requirements for the "Minimum Secret Length." Using a key shorter than these requirements effectively weakens the algorithm.

  • HS256: Requires at least 32 characters (256 bits).
  • HS384: Requires at least 48 characters (384 bits).
  • HS512: Requires at least 64 characters (512 bits).
Security Best Practice

Always store your generated key in an environment variable (.env) and never hard-code it into your Git repository. Use the Copy for .env button above to get the correctly formatted line for your configuration.

Technical Specifications​

  • Entropy Source: Uses Python's secrets module (OS-level cryptographically strong pseudo-random generator).
  • HS256 Support: Recommended length 32+ characters (Hex/Base64).
  • HS512 Support: Recommended length 64+ characters (Hex/Base64).
  • Maximum Length: 512 characters for ultra-secure hardware security module (HSM) compatibility.

Verification​

You can verify the structure of your tokens using the generated key at jwt.io. Paste your key into the "Verify Signature" section to test your implementation.

API Reference​

You can bypass the UI and generate secrets directly via our public API for use in automation scripts, Docker setups, or local development.

Endpoint​

GET https://random-letters-generator.vercel.app/generate-jwt-secret

Query Parameters​

ParameterTypeDefaultDescription
lengthint32The number of characters to generate (8 to 512).
formatstrhexOutput encoding: hex, base64, or string.

Example Usage (cURL)​

# Generate a 64-character Hex secret
curl "https://random-letters-generator.vercel.app/generate-jwt-secret?length=64&format=hex"

JSON Response Schema​

{
  "key": "70baa9ec43504f3e9e5a...",
  "env_format": "JWT_SECRET_KEY=\"70baa9ec43504f3e9e5a...\""
}

Python Integration Example​

Since your backend is built with FastAPI, here is how you can consume your own API programmatically:

import requests

def get_new_secret(length=64):
    url = "https://random-letters-generator.vercel.app/generate-jwt-secret"
    params = {"length": length, "format": "hex"}
    response = requests.get(url, params=params)
    return response.json().get("key")

# Usage
MY_SECRET = get_new_secret()
print(f"Generated Secret: {MY_SECRET}")

Last updated on