diff --git a/examples/basic_verification.rs b/examples/basic_verification.rs
index d3487e8..cd27cc0 100644
--- a/examples/basic_verification.rs
+++ b/examples/basic_verification.rs
@@ -9,10 +9,12 @@ use std::collections::HashMap;
 
 fn main() {
     // Your HMAC secret (shared with the auth gateway)
-    let secret = b"your-super-secret-key-here";
+    // Must be at least 32 bytes (256 bits) for security
+    let secret = b"your-super-secret-key-at-least-32-bytes-long!";
 
     // Create a verifier
     let verifier = TokenVerifier::new(secret)
+        .expect("Secret must be at least 32 bytes")
         .with_clock_skew(60) // Allow 60 seconds clock skew
         .with_format_validation(true); // Validate DID/handle formats
 
@@ -51,7 +53,8 @@ fn main() {
     println!();
 
     // Test invalid signature
-    let wrong_verifier = TokenVerifier::new(b"wrong-secret");
+    let wrong_verifier = TokenVerifier::new(b"wrong-secret-that-is-32-bytes-long!")
+        .expect("Secret must be at least 32 bytes");
     match wrong_verifier.verify(&token) {
         Ok(_) => println!("[FAIL] Should have failed!"),
         Err(AuthError::InvalidSignature) => {
diff --git a/examples/with_session_store.rs b/examples/with_session_store.rs
index 4f398af..16cd33d 100644
--- a/examples/with_session_store.rs
+++ b/examples/with_session_store.rs
@@ -10,9 +10,9 @@ use atauth::{TokenPayload, TokenVerifier};
 use std::collections::HashMap;
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    // Setup
-    let secret = b"your-super-secret-key-here";
-    let verifier = TokenVerifier::new(secret);
+    // Setup - secret must be at least 32 bytes (256 bits)
+    let secret = b"your-super-secret-key-at-least-32-bytes-long!";
+    let verifier = TokenVerifier::new(secret)?;
 
     // Create an in-memory session store (use file path for persistence)
     let session_store = SqliteSessionStore::in_memory()?;