--- title: Stop Recommending JWTs (with symmetric keys) ◆ Truffle... description: This post discusses the issues with using symmetric key JWTs, including the high percentage of guessable keys and the risk of undermining authentication and... canonical: https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co. | daily.dev og:description: This post discusses the issues with using symmetric key JWTs, including the high percentage of guessable keys and the risk of undermining authentication and... og:url: https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt og:image: https://api.daily.dev/og/posts/fnr398fxT.png og:image:alt: Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co. **[Community Picks](https://daily.dev/sources/community)** · 5 min read · 104 upvotes · 12 comments ## Summary This post discusses the issues with using symmetric key JWTs, including the high percentage of guessable keys and the risk of undermining authentication and authorization security. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@fidelski** · 11 upvotes > Horrible to see that so many developers blindly copy-paste examples, even including secret keys. But I think it's wrong to "stop recommending JWTs" - maybe it should be called "stop copy-pasting stuff you don't understand" or "start using your brain" or "get to know the stuff you want to build" or "If you blindly use copilot to make your job you will be screwed sooner or later". **@ivanjuren** · 4 upvotes > Just because people are using it incorrectly, doesn't meen the we should stop using it. **@ashwanthbalakrishnan** · 2 upvotes > Tools like [djecrety.ir](https://djecrety.ir/ ) can be used to generate random secret **@robertoumbelino** · 2 upvotes > Nice post. Many devs do not pay attention to security. **@sachaw** · 0 upvotes > Just use Paseto tokens https://paseto.io/ --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#authorization](https://daily.dev/tags/authorization), [#jwt](https://daily.dev/tags/jwt) [View this post on daily.dev](https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co.","url":"https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt"},"datePublished":"2024-05-20T13:30:23.692Z","dateModified":"2024-05-20T13:30:36.898Z","description":"This post discusses the issues with using symmetric key JWTs, including the high percentage of guessable keys and the risk of undermining authentication and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55a12327f0e331113d2399f4b6782686?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55a12327f0e331113d2399f4b6782686?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Community Picks","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Community Picks","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1655817725/logos/community","url":"https://daily.dev/sources/community"},"commentCount":12,"discussionUrl":"https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":104},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":12}],"keywords":"security,authentication,authorization,jwt","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Community Picks","item":"https://daily.dev/sources/community"},{"@type":"ListItem","position":3,"name":"Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co."}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt","comment":[{"@type":"Comment","text":"Horrible to see that so many developers blindly copy-paste examples, even including secret keys. But I think it’s wrong to “stop recommending JWTs” - maybe it should be called “stop copy-pasting stuff you don’t understand” or “start using your brain” or “get to know the stuff you want to build” or “If you blindly use copilot to make your job you will be screwed sooner or later”.","datePublished":"2024-05-21T08:13:42.895Z","url":"https://daily.dev/posts/fnr398fxT#c-uLTorSj2L","author":{"@type":"Person","name":"fidel","url":"https://daily.dev/fidelski","image":"https://media.daily.dev/image/upload/s--0ZsJYLqU--/f_auto/v1748613623/avatars/avatar_y8DJy71DgFOhtds2Iv5xP?_a=BAMClqUq0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11}},{"@type":"Comment","text":"Just because people are using it incorrectly, doesn’t meen the we should stop using it.","datePublished":"2024-05-22T11:24:25.718Z","url":"https://daily.dev/posts/fnr398fxT#c-WtiGqN8Xy","author":{"@type":"Person","name":"Ivan Juren","url":"https://daily.dev/ivanjuren","image":"https://lh3.googleusercontent.com/a/ACg8ocIyLjfi_DxxT1MdBIc4eOAkQ_8idND1_HW7C7HOs_B7FSL5=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Tools like djecrety.ir can be used to generate random secret","datePublished":"2024-05-21T10:27:34.488Z","url":"https://daily.dev/posts/fnr398fxT#c-nqTlFTAVx","author":{"@type":"Person","name":"Ashwanth Balakrishnan","url":"https://daily.dev/ashwanthbalakrishnan","image":"https://avatars.githubusercontent.com/u/91041406?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Nice post. Many devs do not pay attention to security.","datePublished":"2024-05-21T12:56:41.436Z","url":"https://daily.dev/posts/fnr398fxT#c-rbR3zySpj","author":{"@type":"Person","name":"Roberto Umbelino","url":"https://daily.dev/robertoumbelino","image":"https://avatars.githubusercontent.com/u/17939056?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Just use Paseto tokens https://paseto.io/","datePublished":"2024-05-30T03:02:10.122Z","url":"https://daily.dev/posts/fnr398fxT#c-6EqgNclSD","author":{"@type":"Person","name":"sachaw","url":"https://daily.dev/sachaw","image":"https://avatars1.githubusercontent.com/u/11172820?v=4"}}]} ```