JWT Generator & Signer
Build and sign JWTs with HS256, HS384, or HS512 in your browser. Edit header and payload, supply a secret, and get a ready-to-use token. Nothing is uploaded.
Header
How it works
- The header and payload are encoded as Base64URL, then concatenated as
header.payload. - The signature is an HMAC-SHA2 over that string, keyed with your secret, per RFC 7519 / RFC 7515.
- Signing runs in your browser with
crypto.subtle— the secret is never sent anywhere. - Insert now / Insert exp fill common
iat/exptimestamps for testing.
About JWT Generator & Signer
JWTs are compact, URL-safe tokens used for authentication and authorization — typically a header declaring the algorithm, a payload of claims, and a signature that proves the token was issued by whoever holds the secret. HMAC-signed (HS*) tokens are symmetric: the same secret both signs and verifies, so it must live only on the server. This tool is for local testing, crafting fixtures, and understanding the format — use it alongside the JWT decoder on devops.jsonversal.com to verify what you produced.
Keep your secret out of the payload and out of the header: the header and payload of an HMAC JWT are only base64-encoded, not encrypted — anyone can read them. Never place passwords or sensitive data inside claims, prefer short-lived tokens with an exp claim, and use an asymmetric algorithm (RS256/ES256) when multiple parties must verify tokens without sharing a secret.