# Common JWT HMAC secrets — bundled default wordlist for /api/jwt/brute.
# One secret per line. Lines starting with '#' and blank lines are ignored.
# Curated from jwt-cracker / jwt_tool common lists + framework defaults.
secret
secretkey
secret_key
secretKey
mysecret
my-secret
mysecret123
supersecret
super-secret
supersecretkey
topsecret
secret123
secret1234
secretsecret
password
password1
password123
passw0rd
pass
passwd
admin
administrator
root
toor
changeme
change_me
changethis
default
defaultsecret
test
test123
testing
demo
example
sample
qwerty
qwerty123
123456
1234567
12345678
123456789
1234567890
111111
000000
abc123
letmein
welcome
welcome1
jwt
jwts
jwtsecret
jwt_secret
jwt-secret
jwtSecret
jwtkey
jwt_key
jwtpassword
token
tokensecret
token_secret
mytoken
key
keysecret
private
privatekey
private_key
privateKey
publickey
public_key
signature
sign
signingkey
signing_key
hmac
hmackey
hmacsecret
auth
authsecret
auth_secret
authentication
authkey
api
apikey
api_key
apiKey
apisecret
api_secret
apiSecret
app
appsecret
app_secret
application
appkey
app_key
session
sessionsecret
session_secret
sessionkey
cookie
cookiesecret
cookie_secret
salt
saltsecret
pepper
hash
encrypt
encryption
encryptionkey
cipher
crypto
master
masterkey
master_key
masterpassword
your-256-bit-secret
your_256_bit_secret
your-secret
your_secret
your-secret-key
your_secret_key
yoursecret
yoursecretkey
youwillneverguess
shhhhh
shhh
hidden
verysecret
notsecret
nosecret
keyboardcat
keyboard cat
the cake is a lie
opensesame
open-sesame
iloveyou
trustno1
dragon
monkey
sunshine
princess
football
baseball
superman
batman
ninja
hunter2
access
accesstoken
access_token
refresh
refreshtoken
refresh_token
bearer
oauth
oauthsecret
client
clientsecret
client_secret
clientSecret
clientid
client_id
server
serversecret
server_secret
backend
frontend
production
prod
prodsecret
staging
stage
dev
develop
development
devsecret
localhost
local
debug
unsafe
insecure
temporary
temp
tmp
foo
bar
baz
foobar
hello
helloworld
hello-world
world
nodejs
node
express
expressjs
flask
django
django-insecure
rails
laravel
spring
springboot
symfony
nestjs
fastapi
golang
go
java
python
php
ruby
secret-key-here
replace-me
replace_this
CHANGE_ME
PLEASE_CHANGE_ME
INSECURE
s3cr3t
s3cret
S3CR3T
P@ssw0rd
P@ssword
Passw0rd!
adminadmin
admin123
root123
qazwsx
zxcvbn
asdfgh
asdf1234
1q2w3e4r
1qaz2wsx
secret0
secret01
mykey
my_key
my-key
thekey
thesecret
the_secret
appsecretkey
verystrongsecret
strongsecret
weaksecret
randomsecret
random
seed
nonce
devkey
prodkey
livekey
testkey
mysql
postgres
redis
mongodb
database
db
dbsecret
dbpassword
