JWT Generator
Build and sign a JSON Web Token with HS256, HS384 or HS512 — edit the header and payload and watch the token update live.
Unsigned token: anyone can change its claims. Use it only to test that your verifier rejects
alg: none.
Enter a payload and a secret.
Advanced: header JSON and standard claims
Signing happens locally. The HMAC is computed in this page with the
browser's built-in Web Crypto API (crypto.subtle), so your secret and your
token never leave this device and are never uploaded, logged or stored. Even so, use a
throwaway secret here: never paste a production signing key into any web page, including
this one.
How it works
A JSON Web Token (RFC 7519) is a JWS Compact Serialization (RFC 7515): three parts joined by
dots, base64url(header).base64url(payload).base64url(signature). This generator
minifies your header and payload JSON, base64url-encodes each one without padding, joins them
with a dot to form the signing input, and computes
HMAC-SHA256/384/512 over those ASCII bytes with your secret (the HS256, HS384 and
HS512 algorithms of RFC 7518). The result is base64url-encoded and appended as the third part.
Everything updates live as you type.
The signing runs through the browser's native Web Crypto API, so no secret is transmitted:
the page makes zero network requests and works with your connection switched off. Two things
are worth knowing before you use a token anywhere real. First, the header and payload are only
encoded, not encrypted, so anyone holding the token can read every claim in it: never put
passwords or personal data in a payload. Second, alg: none produces an unsigned
token with an empty signature. It is useful for testing that your verifier rejects it, and for
nothing else. RS256, ES256 and other public-key algorithms need a private key file and are not
supported here; use the HS family, or sign those server-side.
Frequently asked questions
How do I generate a JWT with HS256?
Type your claims as JSON in the payload box, put your shared secret in the secret field and leave the algorithm on HS256. The token is rebuilt on every keystroke: the header and payload are minified, base64url-encoded and joined with a dot, then signed with HMAC-SHA256 over those bytes. Use the helper buttons to drop in an iat, an exp one hour out or a random jti, then press Copy token. Switch the algorithm to HS384 or HS512 and the header alg is rewritten for you.
Is it safe to sign a JWT online?
On this page the signing is done by your own browser through the Web Crypto API, so the secret and the finished token are never uploaded, logged or stored anywhere. The page makes no network requests at all and keeps working with your connection turned off, which you can check yourself. That said, treat any web page as untrusted with real keys: sign test tokens here with a throwaway secret, and keep production signing keys on your server.
Can it sign RS256 or ES256 tokens?
No. This generator covers the shared-secret HMAC family from RFC 7518, that is HS256, HS384 and HS512, plus an unsigned alg none token for checking that your verifier rejects those. RS256 and ES256 need an RSA or elliptic-curve private key rather than a secret string, and a private key is not something you should paste into a browser tool, so generate those server-side with your JWT library instead.