JWT Generator
100% private — runs on your device, never uploaded. Works offline once loaded.
Build and sign a JSON Web Token entirely in your browser: edit the header and payload as JSON, choose HS256, HS384 or HS512, provide a secret, and get the base64url-encoded, HMAC-signed token to copy.
What a JWT is made of
A JSON Web Token is three base64url-encoded parts separated by dots: header.payload.signature. The header declares the token type and signing algorithm (for example {"alg":"HS256","typ":"JWT"}). The payload holds the claims — data such as the subject (sub), issued-at time (iat), expiry (exp) and any custom fields your app needs. The signature is what makes the token tamper-evident.
This tool lets you edit the header and payload as plain JSON and produces a correctly encoded, signed token you can drop into an Authorization header, a test fixture or a debugging session.
How signing works here
For the HS family, signing is an HMAC over the string header_b64 + "." + payload_b64, keyed with your secret. The tool base64url-encodes the header and payload (standard base64 with + and / swapped for - and _, and padding removed), computes the HMAC with the SHA-256, SHA-384 or SHA-512 hash you selected, and base64url-encodes the resulting signature bytes.
All of that runs through the browser's Web Crypto API (crypto.subtle), the same audited primitive libraries use. The token this produces verifies cleanly on jwt.io and in any standard JWT library that shares the secret.
- Header: JSON metadata — the tool keeps alg in sync with your selection.
- Payload: your claims as JSON (sub, iat, exp, roles, anything).
- Signature: HMAC-SHA over header.payload, keyed by your secret.
When to use it
A local JWT generator is handy for developers testing an API that expects bearer tokens, for crafting fixtures in an automated test suite, for reproducing a bug with a specific claim set, or simply for learning how the encoding and signing fit together. Because it is instant and offline, you can iterate on claims without standing up an auth server.
Common claims to include are exp (a Unix timestamp after which the token is invalid), iat (issued-at), iss (issuer) and aud (audience). These are just JSON numbers and strings in the payload editor.
Security caveats
HMAC tokens are only as strong as their secret. HS256 expects a high-entropy key of at least 256 bits; a short, guessable secret can be brute-forced, letting an attacker forge tokens. Never reuse a real production secret in a browser tool — generate a throwaway one for experiments.
Also remember that a JWT payload is encoded, not encrypted: anyone holding the token can read the claims by base64url-decoding the middle segment. Do not place passwords or sensitive personal data in a JWT, and always set a sensible exp so tokens cannot be replayed forever.
Frequently asked questions
Does the generated token verify on jwt.io?
Yes. It follows the JWS compact-serialization spec exactly, so pasting the token and the same secret into jwt.io or any standard library reports a valid signature.
What is base64url and why not plain base64?
Base64url replaces the + and / characters with - and _ and drops the = padding, making the value safe to place in URLs and HTTP headers without escaping. JWT mandates it for all three segments.
Can I set an expiry?
Yes — add an exp claim to the payload as a Unix timestamp in seconds (for example 1716239022). The tool does not enforce it, but any verifier that checks exp will.
Why is the alg in my header overwritten?
To keep the token valid, the tool syncs the header's alg field to the algorithm you selected in the dropdown before signing, so the declared and actual algorithms always match.
Can it sign RS256 or ES256 tokens?
No. This generator supports symmetric HMAC (HS256/384/512). Asymmetric algorithms require a private key and a different flow that is intentionally out of scope for a quick browser tool.
Is any of this sent to a server?
No. Encoding and HMAC signing run entirely in your browser via Web Crypto. That said, treat any secret you type as potentially exposed and never use real production keys.
Advertisement