JWT Generator

Create and sign HS256/HS384/HS512 JWT tokens locally in your browser.

About this tool

Create signed JSON Web Tokens with HMAC algorithms (HS256, HS384, HS512) via the Web Crypto API. Set header and payload as JSON, add a secret, and copy a complete three-part token for local testing.

Useful for prototyping auth flows, integration tests, or learning JWT structure. Pairs with the JWT Decoder, which inspects existing tokens without signing.

Test secrets only. Production signing keys belong in secure server-side storage.

How to use

Pick HS256, HS384, or HS512 in the Algorithm select.
Enter a test-only Secret key (never a production signing key).
Edit Header (JSON) and Payload (JSON) in the two editors.
Click Generate JWT, then Copy token from the Signed JWT pane.

Example

Sign a local HS256 token with a disposable secret

Input

Algorithm: HS256
Secret: test-only-secret
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"user_42","role":"admin","iat":1700000000}

Output

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQyIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzAwMDAwMDAwfQ.JEQ-_rag3sSMZZk5hfFdc34-L6VsMcMIohn1KDFuG-w

Use only throwaway secrets for local experiments.

Limitations

HMAC algorithms only — RSA/ECDSA (`RS256`, `ES256`, etc.) are not available here.
Never paste production secrets or real session keys into the Secret key field.
Header `alg` is overwritten by the Algorithm select when signing; keep them aligned for clarity.

Related guides

JWT Anatomy: Header, Payload, and Signature Explained

Related tools

JWT Decoder

Decode JWT tokens and inspect header and payload.

JWT Verifier

Verify JWT signatures (HS256/384/512) and check expiry locally.

HMAC Generator

Generate HMAC-SHA256, SHA384, and SHA512 message authentication codes.

Hash Generator

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes.

Frequently asked questions

Which signing algorithms does the JWT Generator support?

HS256, HS384, and HS512 using HMAC and the Web Crypto API. The algorithm must match the alg claim in your header JSON.

When should I use the JWT Generator?

For local development, integration tests, and learning JWT structure. Use test secrets — not production signing keys.

Is the JWT Generator free?

Yes. No signup or usage limits.

Is my secret key sent to a server?

No. Signing happens locally in your browser. Still, avoid pasting production secrets into any browser-based tool.

How do I inspect an existing token?

Use the JWT Decoder to view the header and payload of a token without verifying its signature.