JWT Generator

About This Tool

The JWT Generator creates signed JSON Web Tokens using HMAC-SHA algorithms (HS256, HS384, HS512). You supply a JSON payload and a secret key; the tool encodes the header and payload as Base64url, then signs using the Web Crypto API.

All signing happens entirely in your browser via the native crypto.subtle API. Your secret key and payload are never sent to any server. This tool is designed for learning, development, and testing.

How to Use

1. Select an algorithm (HS256 is the most common).
2. Enter your secret signing key in the Secret Key field.
3. Edit the Payload JSON — add or remove claims as needed.
4. Click Generate JWT and then Copy to copy the token.

Use Cases

Used for testing API endpoints requiring JWT authentication, creating tokens with custom expiration times, learning JWT structure, and verifying server-side token generation logic.

FAQ

• Is it safe to use with production secrets? All computation is local, but avoid pasting real production secrets into any web tool as a best practice. Use a throwaway key for testing.
• Does this support RS256 or ES256? Only HMAC-based algorithms (HS256/HS384/HS512) are supported. Asymmetric algorithms require a private key in PEM format.
• What is the difference between HS256, HS384, and HS512? The number indicates the SHA hash length in bits. HS512 produces a longer signature, but the practical security difference is negligible for most applications.