0
$\begingroup$

Which method will generate stronger secret?

64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_- e.g.: hNr3COb9fSz5qfZBCQx3GkpLVW-tbVM0E-Nl8xgcf8Js8-l6fqOIfSd6Gk-T_nkE

or crypto.randomBytes(32).toString('hex') e.g.: d152189824ea6b25c34048960dfa57722d547eff9e4e98a67064d910010e6747

both create 64 character number but I'm not sure which is stronger as a secret for JWT signing (HS256)

$\endgroup$
4
  • 1
    $\begingroup$ Nanoid doesn't seem to be made for this - it generates an ID not a key. Just generating 32 secure random bytes is fine for HMAC/SHA-256 - presuming you are OK with keeping it in software of course, but that's generally OK for tokens. Don't confuse hex / base 64 with the bytes that are encoded using them. $\endgroup$
    – Maarten Bodewes
    Aug 6 at 19:44
  • $\begingroup$ @MaartenBodewes do I understand correctly that decoded secret from .randomBytes() has higher entropy than secret generated from 64 alphabet characters? (e.g. decoded secret: �txK�:O�>�o/2�L�Q�B� has characters like ">" "/" and some that aren't represented in utf-8 e.g. �) so its harder to theoretically brute force it? $\endgroup$
    – wefad12292
    Aug 6 at 20:06
  • $\begingroup$ That depends what is encoded by those characters. Nanoid seems to encode 126 bits of random bits from the same crypto module. For HMAC/SHA-256 you'd normally use a 256 bit / 32 byte key, and larger key sizes are unnecessary. crypto.randomBytes should normally use the RNG of the OS which is fine. Not sure about the exact entropy in there, but on a correctly configured system I'd expect 128 bits minimum. Entropy is always a bit of a laden term when it comes to PRNG's and - sorry - JavaScript / NodeJS documentations is terrible so you'd have to look into the source code to be sure. $\endgroup$
    – Maarten Bodewes
    Aug 6 at 20:20
  • $\begingroup$ @MaartenBodewes got it, thanks a lot. $\endgroup$
    – wefad12292
    Aug 6 at 20:44

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.