JWT Generator
Build and sign a JSON Web Token from a JSON payload, a secret, and an HMAC algorithm (HS256, HS384, or HS512) — the header is generated automatically to match. Updates live as you edit the payload, secret, or algorithm. Signing uses your browser's native Web Crypto API. Runs entirely client-side — nothing is uploaded, and your secret is never stored or logged.
About this tool
This tool builds and signs a JSON Web Token from a JSON payload, a secret, and an HMAC algorithm (HS256, HS384, or HS512) — the counterpart to this site's JWT Decoder, which reads a token apart instead of building one. It only supports HMAC algorithms, which sign and verify with the same shared secret string, rather than RS/ES algorithms, which need an asymmetric private key most people generating a quick test token don't have on hand. The header (alg and typ: "JWT") is generated automatically to match your chosen algorithm — you only write the payload. Signing uses your browser's native Web Crypto API (crypto.subtle) — the same standard, audited implementation browsers use for HTTPS — so nothing about the process is a custom reimplementation of HMAC.
What you can do
- Sign a JSON payload into a valid JWT using HS256, HS384, or HS512
- The header (alg + typ) is generated automatically from your algorithm choice
- Updates live as you edit the payload, secret, or algorithm
- Nothing is uploaded — signing happens locally using your browser's native Web Crypto API
How to use
Step 1
Write your payload
A JSON object with whatever claims you need — sub, name, exp, or anything custom.
Step 2
Pick an algorithm and secret
HS256, HS384, or HS512, and the shared secret to sign with.
Step 3
Copy the signed token
The three-part JWT updates live and is ready to copy.
Example
This payload, secret, and algorithm:
Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Secret
your-256-bit-secret (HS256)
produces the exact token from jwt.io's own reference example — a good way to sanity-check this tool against a token you may already recognize.
How your data is handled
This tool is labeled 🟢 Browser: your payload and secret are used to sign the token directly in your browser via the Web Crypto API — neither is ever uploaded to a server, and your secret is never stored or logged.
Frequently asked questions
Why only HS256/384/512 and not RS256 or ES256?+
HMAC algorithms sign with a plain secret string, which is what most people testing an API or debugging a token have available. RS/ES algorithms require an asymmetric private key, which is a different and more involved setup this tool doesn't try to cover.
Is this safe to use for a real production secret?+
Signing happens entirely in your browser using the Web Crypto API and is never sent anywhere — but as a general rule, avoid pasting real production secrets into any web tool, including this one, when a local script would do.
Do I need to add exp, iat, or other claims myself?+
Yes — this tool doesn't inject any claims automatically beyond the header. Add exp (expiration), iat (issued at), or any other claim you need directly in the payload JSON.
Can I verify a token this tool generated?+
Paste it into this site's JWT Decoder to inspect its header and payload. Decoding doesn't verify the signature, though — that requires checking it against the same secret and algorithm used to sign it.