JWT Generator
Create and sign JSON Web Tokens with HS256, HS384, or HS512.
For production authentication systems, use established authentication libraries and secure key management.
Your secret never leaves this page — it is not transmitted, logged, or stored.
Header
Payload
Secret
The secret is used in-memory only — never transmitted, logged, or stored.
Complete Token
What is the JWT Generator?
The JWT Generator creates signed JSON Web Tokens using HMAC algorithms (HS256, HS384, HS512). You define the header, standard claims like issuer, subject, audience, and expiration, plus any custom claims — and the token is signed with your secret using the Web Crypto API, directly in your browser.
This is ideal for testing API authentication, seeding local development environments, and learning how JWTs are constructed. Your signing secret is used in-memory only: it is never transmitted, logged, or persisted anywhere.
How to use the JWT Generator
- Choose a signing algorithm: HS256, HS384, or HS512.
- Fill in the standard claims you need (iss, sub, aud, exp, iat, nbf, jti) — or add custom claims as JSON.
- Enter your signing secret in the password field.
- Click Generate to create the token, then copy it for use in your tests.
Examples
Generated token structure
eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiJ1c2VyLTEifQ . 4kXInmDVdb…
Three Base64URL segments: header, payload, and HMAC signature.
Custom claims JSON
{
"role": "admin",
"features": ["beta", "reports"]
}Frequently asked questions
Is my secret sent anywhere?
No. Signing runs locally via the Web Crypto API. The secret stays in your browser's memory for the current session only — it is never transmitted, logged, or saved to storage.
Which algorithms are supported?
The symmetric HMAC family: HS256, HS384, and HS512. Asymmetric algorithms like RS256 require key pairs and are better handled by dedicated libraries in your codebase.
Can I use these tokens in production?
Tokens generated here are cryptographically valid, but for production authentication systems you should use established authentication libraries and secure key management — not hand-crafted tokens.
What format does the exp field accept?
Standard JWT numeric dates: Unix timestamps in seconds. The quick-set buttons compute common lifetimes (1 hour, 1 day, 30 days) for you.
Related developer tools
JWT Decoder
Decode JWT headers, payloads, and claims — entirely in your browser.
Security & Encoding
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes with Web Crypto.
Security & Encoding
Base64 Encoder / Decoder
Encode and decode Base64 text with full UTF-8 support.
Security & Encoding
UUID Generator
Generate cryptographically secure UUID v4 identifiers in bulk.
Generators