JWT Generator
This JWT Generator builds a signed JSON Web Token from a JSON payload and a secr
This JWT Generator builds a signed JSON Web Token from a JSON payload and a secr
How to use JWT Generator
- Pick an HMAC algorithm and enter your JSON payload of claims.
- Type your secret key, and optionally set an expiry in seconds and toggle the iat claim.
- Copy the signed JWT from the output and use or verify it with the same secret.
About JWT Generator
This JWT Generator builds a signed JSON Web Token from a JSON payload and a secret key, entirely in your browser. Choose an HMAC algorithm (HS256, HS384, or HS512), paste your claims, and the tool encodes the header and payload as Base64url, then signs them using the WebCrypto API. The result is the standard three-part token: header.payload.signature.
You can optionally add an issued-at (iat) claim and an expiration (exp) claim by entering a lifetime in seconds. The payload is validated as JSON before signing, so a missing comma or brace shows a clear message instead of a broken token. A decoded view of the header and payload is shown alongside the token so you can confirm exactly what was signed.
This tool only supports HMAC (shared-secret) algorithms, not RSA or ECDSA signing (RS256, ES256), because those need a private key you should not paste into a web page. Everything runs locally using your browser's built-in crypto: no payload, secret, or token is ever uploaded or logged. Because it runs client-side, use it for development and testing rather than minting production tokens with a real secret.
Frequently asked questions
- What algorithms does this JWT generator support?
- It supports the HMAC family: HS256, HS384, and HS512. These use a single shared secret to sign and later verify the token. Asymmetric algorithms like RS256 or ES256 are not supported, since they require a private key that should never be pasted into a browser page.
- Is my secret key or payload sent anywhere?
- No. Signing happens entirely in your browser using the built-in WebCrypto API. Your JSON payload, secret, and the generated token never leave your device and are not stored or logged.
- How do the iat and exp claims work?
- If you enable the issued-at option, an iat claim is set to the current Unix time in seconds. If you enter a number of seconds in the Expires in field, an exp claim is added at the current time plus that many seconds. Leave the field blank to omit exp.
- Can I verify the token I generated?
- Yes. Copy the token into any JWT debugger or your backend library and verify it with the same algorithm and secret you used here. The signature is a standard HMAC over the Base64url header and payload, so any compliant verifier will accept it.
- Why is my payload showing an error?
- The payload must be a valid JSON object, such as { "sub": "123", "name": "Jane Doe" }. Common causes are a trailing comma, a missing quote or brace, or pasting an array or bare value instead of an object.
- Should I use this for production tokens?
- Use it for development, learning, and testing. Because signing is done client-side with a secret you type in, it is not a substitute for generating tokens on a secured server where your real secret is kept private.