JWT Generator

One input per line. Output is numbered to match the input order.
Pinned tools are listed in your favourites on the home page.Copies a link to this tool that carries your current input, so it opens ready to run.Gives you an iframe snippet for putting this tool on your own site.

Signing uses the browser's WebCrypto HMAC implementation (crypto.subtle.sign). The secret is typed into this page and used here — it is never sent to a server, never logged, and never stored. Only HMAC algorithms are offered: RS/ES signing would require pasting a private key into a web page.

Ctrl+Enter Run  · Ctrl+Shift+C Copy  · Esc Clear

Understand JWT Generator

Builds a JSON Web Token from a header and payload you supply and signs it with HMAC-SHA-256, 384, or 512 using your secret, entirely in your browser.

How it works

The header and payload JSON are Base64URL-encoded and joined with a dot, and that string is the signing input. WebCrypto computes an HMAC over it with your secret, and the result is Base64URL-encoded and appended as the third segment. Verification is the identical operation: a server recomputes the HMAC over the first two segments and compares. Because HMAC is symmetric, anyone able to verify a token is also able to mint one.

When to use it

  • Producing a test token with specific claims to exercise an authorization path.
  • Reproducing a token an identity provider issued, to isolate whether a bug lives in issuance or in verification.
  • Checking that your verification code actually rejects an expired exp, a wrong aud, or a future nbf.
  • Creating a fixture token for an integration test where the signing secret is a known test value.
  • Seeing exactly which bytes are signed, when a hand-rolled signing implementation disagrees with a library.

Watch out for

  • A token is only as trustworthy as its secret. Do not paste a production signing secret into any web page — treat a secret that has been in a browser as burned, and rotate it.
  • HS256 security is capped by the key, not the algorithm. A short or dictionary secret is cracked offline from a single captured token, because the token itself gives an attacker everything needed to test guesses. Use at least 32 random bytes.
  • exp, iat, and nbf are seconds since the epoch. A millisecond value in exp produces a token that effectively never expires, and conforming verifiers will accept it without complaint.
  • Signing is not encryption. Every claim in the payload is readable by anyone holding the token; a signed JWT protects claims from modification, never from being read.

Not the right tool for: Issuing tokens your production system will accept. Sign those inside your service, and prefer an asymmetric algorithm such as RS256 or EdDSA so verifiers hold only a public key and cannot forge tokens of their own.

Frequently Asked Questions

How do I generate a JWT token?

Pick an algorithm, edit the payload JSON, add claims such as iss, sub, aud and an expiry, then enter your signing secret and click Sign JWT. The header, payload and HMAC signature are base64url-encoded without padding and joined with dots.

Is it safe to enter my JWT secret here?

The secret is used by crypto.subtle.sign inside your browser tab. It is never sent to a server, never logged and never stored. Even so, treat a production signing secret carefully — for testing, generate a throwaway secret rather than pasting the live one.

Why are RS256 and ES256 not offered?

Those algorithms sign with a private key, and pasting a production private key into any web page is a bad habit worth not teaching. Only HMAC algorithms are offered here. The alg value "none" is likewise absent — it is the classic JWT bypass attack, not a feature.

How to Use JWT Generator

  1. Paste or type your input in the input area above.
  2. The tool processes your input automatically or click Run.
  3. Copy or download the result using the action buttons.
  4. Use Ctrl+Enter to run quickly from the keyboard.