JWT Generator

What this tool does

Edit a header and payload as plain JSON, choose an HMAC algorithm and secret, and get back a fully signed JSON Web Token — header.payload.signature, Base64URL-encoded and ready to use. Useful for mocking an authenticated request, seeding a test fixture, or just seeing how a change to a claim affects the final token.

Why only HMAC (HS256 / HS384 / HS512)?

HMAC algorithms sign with a single shared secret, which is something you can type into a text field. Asymmetric algorithms like RS256 or ES256 sign with a private key instead — generating and safely handling a real key pair is a different kind of tool than a browser-based generator should be encouraging. If your API expects RS256/ES256, sign tokens with your backend's existing key management instead of pasting a private key into any web page, this one included.

How the token is built

1. The header and payload are each JSON-stringified and Base64URL-encoded.
2. The header's alg field is set to whatever algorithm you picked below, overriding anything typed in the header editor — that keeps the header always consistent with what actually signs the token.
3. The two encoded segments are joined with a dot, then signed with HMAC using your secret and the selected hash function.
4. The resulting signature is Base64URL-encoded and appended as the third segment.

FAQ

Is this safe to use for real production secrets?

Signing happens entirely in your browser using the Web Crypto API — the secret and token never leave your device. That said, treat any secret typed into a browser tool as exposed to your local machine; for production signing keys, prefer generating tokens server-side.

How do I check a token I already have?

Paste it into our JWT Decoder to inspect the header and payload and see expiration status at a glance.

What's actually happening when I check "Secret is Base64 encoded"?

By default the secret is treated as raw UTF-8 text. Some systems instead generate a random secret and store it Base64-encoded — checking this box decodes it back to bytes first, the same way Base64 Decode would, before using it as the HMAC key.