JWT Generator

What this tool does

JWT Generator builds a signed JSON Web Token from a JSON payload and a chosen HMAC algorithm (HS256, HS384 or HS512), computing the signature with the browser’s native Web Crypto API entirely client-side. Only HMAC-based algorithms are supported, since RSA/ECDSA signing requires a private key.

Testing a JWT-authenticated API endpoint, or exploring how a given payload and secret produce a specific token, usually means writing a small script just to generate a sample token, overkill for a quick manual test.

This generator builds a complete, signed JWT from a JSON payload, a chosen HMAC algorithm, and a secret, computing the actual HMAC signature with the browser’s native Web Crypto API entirely client-side, no server involved, producing a ready-to-use token for local testing.

How to use JWT Generator

1. Choose the signing Algorithm (HS256, HS384 or HS512).
2. Enter the Secret that will be used to sign the token.
3. Edit the Payload JSON (standard claims like sub, iat, exp are pre-filled as an example).
4. Press Generate JWT and copy the signed token.

Tips for better results

• Only HMAC algorithms (HS256/384/512) are supported, since they need just a shared secret, which can be handled entirely client-side; RSA/ECDSA algorithms (RS256, ES256) require a private key and are a fundamentally different, server-side operation.
• This is intended for local testing and learning, not for issuing real production tokens, since the secret is visible directly in this page and never meant to be treated as a secure signing environment.
• The payload must be valid JSON; a syntax error there is reported clearly before any signing is attempted.
• Pair this with the JWT Decoder to round-trip a token you’ve generated and confirm the claims decode exactly as expected.

Common use cases

• Generating a sample signed JWT for local API testing without writing a script.
• Understanding exactly how a JWT’s three parts (header, payload, signature) are constructed and combined.
• Creating test tokens with specific claims (like a custom exp time) for testing expiry handling.
• Learning the difference between HMAC-based and asymmetric JWT signing algorithms.

Common mistakes to avoid

• Using a generated token or secret for anything in production; this tool is built for local testing and learning, with the secret visible on the page, not for issuing real authentication tokens.
• Expecting RS256 or ES256 support; those require a private/public key pair, a fundamentally different and more involved setup than the shared-secret HMAC algorithms this tool supports.
• Forgetting that iat and exp are Unix timestamps in seconds, not milliseconds, a common off-by-1000 mistake when setting a custom expiry.