JWT Generator

How to use the JWT Generator

1. Choose the signing algorithm (HS256/384/512).
2. Edit the payload JSON with your own claims, and enter a secret.
3. Click Generate & Sign to build the signed token.
4. Click Copy to use the token — paste it into the JWT Decoder to inspect it.

Privacy: this tool runs entirely in your browser. Your input is never sent to, received by, or stored on any server — there are no uploads and no tracking of what you enter.

About JWT Generator

Creating a signed JWT

Provide a JSON payload (the claims) and a shared secret, choose an HMAC algorithm (HS256, HS384 or HS512), and the tool produces a complete header.payload.signature token ready to use in an Authorization header.

HMAC signing

HMAC algorithms sign the token with a symmetric secret. The same secret is needed to verify it later. For public/private key signing (RS256/ES256) you would generate the signature server-side with your private key.

Use responsibly

Generated tokens are only as secure as your secret. Use a long, random secret, and remember that anyone with the secret can mint valid tokens.

Frequently asked questions

Understanding JWT Generator in depth

What this generator does

This tool builds and signs a JSON Web Token from a payload and secret you provide, entirely in your browser. It is the counterpart to a JWT decoder: instead of inspecting an existing token, you create a fresh, valid one — invaluable for testing authentication flows, seeding API requests, and learning exactly how the three parts of a JWT fit together.

How signing works

The generator takes your claims as JSON, Base64URL-encodes a header and the payload, joins them with a dot, and computes an HMAC signature over that string using your secret. For HS256 the signature is HMAC-SHA256(header.payload, secret); HS384 and HS512 use the larger SHA-2 hashes. The three Base64URL parts are then joined with dots to form the finished header.payload.signature token.

HMAC and the Web Crypto API

Signing uses the browser's native Web Crypto API, the same vetted cryptographic implementation browsers use for HTTPS — not a hand-rolled routine. Crucially, your secret and payload never leave the page: there is no server round-trip, so you can safely experiment with realistic claims. The same secret is needed later to verify the token, which is the nature of symmetric (HMAC) signing.

Symmetric versus asymmetric tokens

This generator focuses on HMAC (HS*) tokens, where one shared secret both signs and verifies — perfect for testing and for server-to-server use. Production systems that need many parties to verify tokens issued by a single authority use asymmetric algorithms (RS256, ES256): a private key signs, and a freely-distributable public key verifies. Those require key-pair generation and are usually handled server-side.

Using it responsibly

A generated token is only as trustworthy as its secret, so use a long, random secret and never commit real production secrets into a browser tool you do not control. Keep payloads small, set a sensible exp expiry, and remember the payload is readable by anyone — never put passwords or sensitive data in it. Paste the result into the JWT Decoder to confirm it parses and to check the expiry.

Related & complementary tools

• 🔑 JWT decoder — to verify the token you just generated
• #️⃣ hash generator — to see how HMAC signatures are produced
• 🔤 Base64 encoder — for the underlying encoding

More Tokens tools