Hacker News Reader

Definitely, you would be surprised by the amounts of JWT using very simple secrets

Yeah - that's unfortunate. The spec clearly outlines a required minimum key length and it could be easily enforced in JWS libraries to make things more secure.

Reply on news.ycombinator.com