JWT Generator
Build and sign a JWT (JSON Web Token) with a custom header, payload, and HMAC-SHA256 secret — instantly inside your browser.
What is a JWT?
A JSON Web Token (JWT) is a compact, signed token made of three Base64URL-encoded parts separated by periods: a header describing the signing algorithm, a payload holding claims (data), and a signature that proves the token wasn't tampered with. They're widely used for authentication — a server issues a signed JWT after login, and later verifies its signature to trust the claims inside without needing a database lookup.
This tool builds and signs a JWT from a custom header and payload using HMAC-SHA256 (HS256), the most common JWT signing algorithm.
GuideHow to use it
How the signing works
The header and payload are each Base64URL-encoded, joined with a period to form the signing input, then signed using HMAC-SHA256 with your secret via the browser's Web Crypto API. The resulting signature is Base64URL-encoded and appended as the third part, producing the standard header.payload.signature JWT format.
Features & benefits
Why this runs entirely in your browser
A JWT signing secret is as sensitive as a password, so signing happens entirely locally using the Web Crypto API, and nothing typed here is ever sent to a server.
Common uses
Generating a test token for API development, creating a sample JWT to debug a backend integration, or learning how JWT header, payload, and signature fit together.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
This tool signs with HMAC-SHA256 (HS256), the most common symmetric JWT algorithm. Asymmetric algorithms like RS256 require a private key rather than a shared secret and aren't supported here.
No, this tool creates and signs tokens. Use a dedicated JWT decoder to inspect an existing token's header and payload.
Those are the standard JWT header fields — "alg" declares the signing algorithm and "typ" identifies the token type, both expected by JWT-consuming libraries.
It's mathematically correct, but generating tokens in a browser tab is best suited for testing and development — production tokens should be issued by your actual backend with a securely stored secret.
No. All signing happens locally in your browser using the Web Crypto API. Nothing typed here is sent to a server, stored, or shared.