What should be the "secret" in the JWT?

Question

I am going to apply JWT in my REST API developed using Java-Jersey. I use this library for JWT - https://github.com/auth0/java-jwt

I have few questions about JWT-Secret

• Should this Secretbe unique?
• Should I use a hashed version of the user's password for privacy? (In any case, this is not unique). This is because when a user changes his password, his token will be automatically invalid.

Answer 1

• Should this Secretbe unique?

— , ? . , (, , , ).

2. ?

, :

• , , GoPackers123. , - , , ; , , , , - . , , .
• , . , .

Answer 2

JWT java-jwt , :

• , HS256, , .

• , RS256, . . ( , ).

, !

. kid , . , , .

kid..

Answer 3

RSA256, .. / ( "" ). , ( ), , , .

You can provide the public key to anyone or any service that needs to verify the validity of the token signature.