JWT Generator & Signer (HS256/HS384/HS512)
Builds an HMAC-signed JWT from header and payload JSON and a secret key. Use it to create test tokens for an authenticated API or to learn how JWTs work. Everything runs in your browser, and your key and token are never sent to a server. To inspect a token, use the JWT Decoder.
🔒 Runs in your browser · Your data is never sent to a server
The secret key is empty. Anyone can forge a token signed with an empty key, so use it only for testing.
Notes
- The header "alg" is always overwritten with the selected algorithm, and "typ" is set to JWT if it is missing.
- The JSON is compacted to one line before signing, so spaces and line breaks you type are not part of the signature.
- Only HMAC algorithms (HS256/384/512) are supported. Public-key algorithms such as RS256 and ES256 are not.
- Prefer a test key over a production secret. A JWT payload is not encrypted and can be read by anyone, so do not put sensitive data in it.
Glossary
JWT (JSON Web Token)
A token made of a header, a payload and a signature, each Base64URL-encoded and joined with dots. It is commonly used to pass authentication information.
HS256 / HS384 / HS512
Signing methods that use HMAC with SHA-2 and a shared secret key. The same key is used to sign and to verify.
iat / exp
Standard claims for the issued-at time and the expiration time, given as UNIX seconds since 1970.
FAQ
Can I generate RS256 or ES256 JWTs?
No. Only HS256, HS384 and HS512, which are signed with a shared secret key, are supported. Public-key algorithms such as RS256 and ES256 are not.
Why does my generated JWT fail verification in another library?
A mismatched secret is the most common cause. Check whether the key is treated as text or hex, and whether a Base64-encoded key was passed as a plain string. The verifier must also allow the same algorithm you selected here.
Is the payload hidden?
No. A JWT payload is signed but not encrypted, so anyone who gets the token can Base64URL-decode and read it. Do not put passwords or other sensitive data in it.
Can I set "alg" in the header myself?
The header "alg" is always overwritten with the algorithm you select. This prevents creating a token whose declared algorithm does not match how it was signed.
Share this page