JWT Generator

The JWT Generator is a free browser-based tool that builds and signs JSON Web Tokens from an editable header and payload. You choose an HMAC algorithm, enter a secret, and it Base64URL-encodes the header and payload then signs them with crypto.subtle to produce a complete, ready-to-use signed token — all locally, so your secret never leaves the browser.

What is a JSON Web Token?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three parts joined by dots: a header that names the signing algorithm, a payload that holds the claims (like who the user is and when the token expires), and a signature that proves the token was not tampered with. This tool creates the signed version; if you already have a token and want to inspect it, the companion JWT Decoder pulls the header and payload apart for you.

How to generate a signed JWT

1. Edit the Header JSON if needed — the alg field stays in sync with the algorithm selector automatically.
2. Edit the Payload JSON with your claims, or use the handy buttons to insert iat, exp, sub, and iss.
3. Pick an algorithm — HS256, HS384, or HS512.
4. Enter your secret (the shared HMAC key).
5. The signed token updates as you type; click Copy to grab the full header.payload.signature string.

Why use a client-side JWT generator?

Because signing a token means handling a secret, and a secret should not be sent to a stranger's server. Everything here runs in your own tab using the native Web Crypto API, so the header, payload, and signing key stay on your machine. That makes it safe for building test tokens, prototyping an auth flow, or teaching how JWTs work without any privacy trade-off.

• Live signing: the token regenerates instantly as you edit the JSON, algorithm, or secret.
• Real HMAC: signatures are produced with crypto.subtle, not a mock — they verify against any standard library.
• JSON validation: the header and payload editors flag malformed JSON before signing.
• Claim shortcuts: one click inserts standard registered claims with sensible defaults.
• Zero dependencies: pure vanilla JavaScript, no external libraries loaded.

How does the signing actually work?

The tool JSON-stringifies your header and payload, encodes each as Base64URL, and joins them with a dot to form the signing input. It then imports your secret as an HMAC key and signs that input with the chosen SHA variant. The raw signature bytes are Base64URL-encoded and appended, giving the final header.payload.signature token. Base64URL is a URL-safe variant of Base64, and if you want to see plain encoding in isolation the Base64 Encode and Decode tool demonstrates how bytes map to safe ASCII. The underlying HMAC construction is the same one exposed directly by the HMAC Generator, and the SHA-256 digest at the heart of HS256 is what the SHA-256 Hash Generator computes on its own.

Signing versus encryption: what a JWT does not do

A signed JWT protects integrity, not confidentiality. Anyone can Base64-decode the payload and read every claim, so the signature only guarantees the content was not changed by someone without the secret — it does not hide anything. If you need the contents themselves to be unreadable, that is a job for encryption, such as the AES Text Encryption tool. Use this generator when you want a verifiable token, and never place passwords or other secrets inside its claims.

Frequently Asked Questions

Is my secret or payload sent to a server?

No. The header, payload, and secret are all processed inside your browser with the Web Crypto API. Nothing is uploaded, logged, or stored anywhere, which is why the secret never leaves your device.

Which algorithms are supported?

HS256, HS384, and HS512 — the HMAC family, which sign and verify with a single shared secret using SHA-256, SHA-384, and SHA-512 respectively. Asymmetric algorithms like RS256 require a private key pair and are not part of this tool.

Should I paste my real production secret here?

No. Even though everything runs locally, it is bad practice to paste real production signing secrets into any web tool. Use a throwaway or test secret here, and keep production keys in your server environment.

What are the iat and exp claims?

They are timestamps in seconds since the Unix epoch. The iat claim marks when the token was issued and exp marks when it expires. The claim buttons set iat to now and exp to one hour ahead by default; edit the numbers to suit your needs.

Is the payload encrypted?

No. A JWT payload is only Base64URL-encoded, not encrypted, so anyone holding the token can read its claims. The signature proves the claims were not altered, but it does not conceal them. Never store sensitive data in the payload.

Can I verify or decode a token I already have?

This tool builds and signs new tokens. To read the header and payload of an existing token, use the JWT Decoder, which splits and decodes the three parts for inspection.