Key management and entropy

Applications that sign tokens with a keyed MAC algorithm such as "HS256" sometimes supply a weak symmetric key with insufficient entropy, such as a human-memorable password; once an attacker obtains such a token, those keys fall to offline brute-force or dictionary attacks. RFC 8725 requires following the Key Entropy and Random Values advice in RFC 7515 Section 10.1 and the Password Considerations in RFC 7518 Section 8.8. In particular, human-memorizable passwords MUST NOT be used directly as the key to a keyed-MAC algorithm such as "HS256", and passwords should only be used for key encryption rather than content encryption — even then, password-based encryption remains subject to brute-force attacks. Two further key-discipline rules: each key MUST be used with exactly one algorithm, checked at operation time, and using different keys for different kinds of JWTs is a recognized substitution defense, because keys validating one kind of JWT fail to validate the others. Scope: JWT security. Reviewed October 4, 2026.