How to safely store & process secret key for JWT
<p>After reading this: <a href="https://stackoverflow.com/questions/30089604/jwt-whats-a-good-secret-key-and-how-to-store-it-in-an-node-js-express-app">JWT: What&#39;s a good secret key, and how to store it in an Node.js/Express app?</a>, on how to store "secret key" to assign JWT tokens. I had security questions. My data (messages, username, etc...) are going to be encrypted (in database) and only authorised users can decrypt it (based on their private key). Since JWT tokens are generated using 1 "secret key" which is stored on the server, in case an attacker gets the "secret key" and get's hold of the database - tokens can be forged and therefore data can be decrypted bypassing "password", which makes encryption pointless. To protect the "secret key", I could use these methods </p>

<blockquote>
  <p>Method 1</p>
</blockquote>

<p>Store the "secret key" on a separate server (like HSM) which will be received during login and then used to set the token</p>

<blockquote>
  <p>Method 2</p>
</blockquote>

<p>Encrypt some kind of salt for each user and use it as the "secret key"</p>

<hr>

<p>I'd like to hear your thoughts and ideas. How does facebook or twitter do it? Do I really need HSM to store private keys for encryption or there's some kind of alternative (eg: safe file system) ?</p>