JWT Generator
Write a JSON payload, choose an HMAC algorithm and a secret, and get back a signed JWT ready to test against your application — nothing you enter is ever transmitted or stored.
Overview
A JWT is a header and payload, Base64URL-encoded and joined with a signature — the signature is what proves the token wasn't tampered with, computed over the encoded header and payload using a secret only the issuer (and anyone it shares the secret with) knows. This tool builds that signature client-side using the Web Crypto API's native HMAC support, so it works for the three HMAC-family algorithms (HS256, HS384, HS512) without needing a server round-trip.
It's meant for testing auth flows, mocking a token an API expects, or understanding how a JWT's signature is actually computed — not for issuing tokens for a real production system, which should sign with a secret that never touches a browser.
Examples
HS256 with a sample payload
{"sub":"1234567890","name":"John Doe","iat":1516239022}
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How It Works
- Write the token's payload as JSON — the claims you want the token to carry.
- Choose a signing algorithm: HS256, HS384, or HS512.
- Enter a secret — the same one your application will verify the token with.
- Click Generate to get the signed token, ready to copy.
FAQ
No. The token is built and signed entirely in your browser using the Web Crypto API — the secret and payload never leave your device.
HMAC algorithms sign and verify with the same secret, which the Web Crypto API can do natively in a browser. RS256 signs with an RSA private key — generate one with the RSA Generator tool, which is a separate concern from building the token's HMAC signature here.
Only if you're testing against a system that shares this exact secret and you generated the secret yourself. Never reuse a real production signing secret in a browser-based tool.
Yes — use the JWT Decoder tool to inspect an existing token's header and payload without needing the signing secret.