JWT Secret Strength

You inherited a project where JWT_SECRET is literally supersecret, and you need a number to convince the team to rotate it. Paste the value into the box and the tool reports three things: length in bytes, an estimated entropy in bits, and a rating running from weak to excellent. Everything recalculates on each keystroke, with no button to press.

The arithmetic is simple and worth knowing. Length comes from the UTF-8 encoding, so accents and emoji count as more than one byte. The alphabet size is estimated by adding 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols, depending on which classes appear, and entropy is the character count times the base-2 logarithm of that total. The rating, however, looks only at byte length: under 16 weak, under 32 medium, under 64 good, excellent beyond that.

The formula assumes every character was drawn at random, which is rarely true. Thirty-two repeated letter a's score 150 bits and land on good, yet fall on the first guess. Read the number as a floor, not a certificate: it is great at rejecting short secrets and useless at approving invented phrases. RFC 7518 asks for a key of at least 32 bytes for HS256; generate yours with openssl rand -base64 48. The analysis runs in the browser and nothing is sent anywhere.