What secret key to use in JWT?

Question

JSON Web Token

Yes, they say to use one key, for example, qwerty for all users, but the problem is that if so, then if an attacker recognizes qwerty, then he will take over all user accounts, shouldn't the key be unique for all users, if so, for example, what to use?

Answer 1

You can find out the key only by hacking the server. In this case, someone's knowledge of the key would be the least of the problems.

Answer 2

Generate a normal key, of adequate length and complexity, as far as I understand, this is just a salt used for hashing when generating a token, knowing it does not mean that you know all logins and passwords, it only means that without knowing this salt you cannot artificially generate a valid token

Answer 3

First, there are 2 main ways to generate signatures: HS (symmetric) and RS (asymmetric) tokens. Of course, you should use asymmetric ones for greater reliability.
Second, JWT is not about security. All information in the token is public and only the client decides how to treat it. You can always ask the server about the validity of this token.