JWT Generator
Create signed JSON Web Tokens (HS256/384/512) from a header, payload and secret — signed locally with Web Crypto, nothing uploaded.
About the JWT Generator
This JWT generator builds a signed JSON Web Token from your payload and secret. Edit the claims, choose an HMAC algorithm (HS256, HS384 or HS512), enter the shared secret, and the tool produces the complete header.payload.signature token, signed locally with the Web Crypto API.
It's ideal for testing authentication flows, seeding fixtures and debugging — generate a token with specific claims (sub, exp, custom roles) and drop it straight into an Authorization header. The header and payload are shown as editable JSON so you control every field.
Signing happens entirely in your browser; the secret and token never leave your machine. For production, tokens should be issued by your backend — this tool is for development and learning.
How to Use the JWT Generator
- 1Edit the payload JSON with your claims (sub, exp, custom fields).
- 2Choose the HMAC algorithm (HS256, HS384 or HS512).
- 3Enter the shared secret.
- 4Generate the token and copy the signed JWT.
Frequently Asked Questions
Which signing algorithms are supported?
The HMAC family — HS256, HS384 and HS512 — which sign with a shared secret. These are the most common symmetric JWT algorithms. RSA and ECDSA (RS256, ES256), which use a private key, aren't generated here; for those, sign on your server with the private key.
How do I set an expiry on the token?
Add an exp claim to the payload as a Unix timestamp (seconds since 1970). For example exp: 1893456000. Verifiers reject the token after that time. You can also add iat (issued at) and nbf (not before) the same way. Use the Unix Timestamp Converter to get the number.
Is it safe to enter my secret here?
Signing runs entirely in your browser via Web Crypto — the secret is never transmitted or stored. That said, for real production secrets, prefer generating tokens on your backend. Use this tool with development secrets or throwaway values while testing.
Can this token be verified elsewhere?
Yes. Any standard JWT library verifies it if given the same algorithm and secret. Use the JWT Verifier tool to check it, or your backend's jwt library. The token follows the standard base64url(header).base64url(payload).signature format.
Should JWTs contain sensitive data?
No. The header and payload are only base64url-encoded, not encrypted, so anyone with the token can read them. The signature prevents tampering, not reading. Never put passwords or secrets in claims; keep confidential data server-side.