Generate Secure JWT Secret Keys via Terminal on macOS

Generating a JWT secret key for symmetric algorithms (e.g., HS256) requires a cryptographically secure random string. Node.js and OpenSSL are bundled or easily installed on macOS, enabling direct generation from Terminal.

1. Generate Hexadecimal Secret with Node.js

Install Node.js via Homebrew if missing:

brew install node

Generate a 32-byte (64 hex characters) secret:

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Use the output as your JWT secret in environment files or application configs:

JWT_SECRET=your_generated_string_here

Reference: Node.js Crypto RandomBytes

2. Generate Base64 Secret with OpenSSL

Use built-in OpenSSL on macOS:

openssl rand -base64 32

For longer secrets (~80 chars):

openssl rand -base64 60

Set the output as your JWT secret:

JWT_SECRET=your_generated_string_here

Reference: OpenSSL RAND Manual

3. Generate Asymmetric Keys (RS256) with ssh-keygen

For RS256, generate a PEM-encoded RSA keypair:

ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key -N ""
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub

Reference: Apple Security Keys

Recommendations

• Keep secrets private; never commit to version control.
• Use at least 32 bytes (256 bits) for symmetric secrets.
• Rotate keys if compromised.
• Use jsonwebtoken or similar libraries for signing.