JWT Generator
Create and sign an HS256 JSON Web Token from your own payload and secret — signed locally with WebCrypto, never sent to a server.
Need to inspect a token instead? Decode a JWT.
Signing happens locally with WebCrypto — your secret and payload never leave the browser.
Sign a JWT for testing in seconds
Building or debugging an auth flow and need a valid token to throw at your API? Set the payload claims, enter your HS256 secret, and this tool produces a properly signed header.payload.signature token you can copy straight into an Authorization: Bearer header. No backend, no library, no round-trip — just a real signed JWT.
How the signing works
The token's header and payload are Base64URL-encoded JSON; the signature is an HMAC-SHA256 over both, computed with your secret via the browser's WebCrypto API. Because the secret never leaves the page, you can experiment freely. When you're done, drop the result into the JWT Decoder to confirm the claims and verify the signature end-to-end.
FAQ
Which signing algorithm does this use?
HS256 — HMAC with SHA-256 — signed with the shared secret you provide, using the browser's built-in WebCrypto API. HS256 is the most common symmetric JWT algorithm and is ideal for tokens your own backend both issues and verifies.
Can I generate RS256 tokens?
Not here. RS256/ES256 sign with a private key and verify with a public one, which belongs in a backend with proper key management. This tool focuses on HS256 shared-secret tokens for local testing and debugging.
Is it safe to enter a real secret?
Signing happens entirely in your browser with WebCrypto — the secret and payload are never sent anywhere, which you can confirm in your network tab. Still, prefer test secrets for throwaway tokens and keep production secrets in your server's environment.
How do I add expiry to my token?
Add an exp claim to the payload as a Unix timestamp (seconds) in the future. You can also include iat (issued at) and nbf (not before). Servers reject the token once exp is in the past.
How do I check the token I just made?
Paste it into the JWT Decoder to inspect the header, payload and expiry, and to verify the HS256 signature with the same secret.
Free tools are just the start
Deploy your next app on bare-metal cloud with per-second billing — your first app is free, no credit card required.
More free tools
Encode text to Base64 or decode it back — UTF-8 safe, with URL-safe variant support.
Percent-encode strings for safe use in URLs, or decode %20-style sequences back to text.
Decode a JSON Web Token's header and payload, check expiry, and verify HS256 signatures.
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes of any text — instantly, in your browser.
Escape text for safe HTML embedding or decode &-style entities back to plain text.
Convert an image to a Base64 data URI with ready-to-paste HTML and CSS snippets — fully offline.