JWT Generator

Runs in browser Security

Build a token by editing the header and payload JSON, choose an HMAC algorithm and secret, and get a signed JWT using WebCrypto in your browser. Useful for testing authentication flows and API authorisation.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use JWT Generator

  1. Edit the payload JSON (claims such as iss, sub, aud, roles).
  2. Pick the HMAC algorithm and enter the shared secret your API uses.
  3. Optionally set an expiry relative to now (e.g. 60 minutes) and stamp iat.
  4. Click Generate and copy the signed token into your Authorization header.

JWT Generator features

  • Editable header and payload JSON with a realistic sample
  • HS256, HS384 and HS512 signing with WebCrypto — nothing leaves the browser
  • Secret as UTF-8 text or Base64/Base64url-encoded bytes
  • One-click "exp from now (+minutes)" and "iat = now" helpers
  • Warns about short secrets, missing exp or already-expired tokens
  • Shows the three segments, sizes and a ready-to-use curl command

JWT Generator example

Sign a token for an API test

Input:

Payload: {"sub":"user_8f3a2c","aud":"api://orders","roles":["admin"]}
Algorithm: HS256 · Secret: your-256-bit-secret · exp: +60 minutes

Output:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzhmM2EyYyIsImF1ZCI6ImFwaTovL29yZGVycyIsInJvbGVzIjpbImFkbWluIl0sImV4cCI6MTcwMDAwMzYwMH0.<signature>

Frequently asked questions about JWT Generator

Which algorithms are supported?

HS256, HS384 and HS512 — the HMAC family that only needs a shared secret. Asymmetric algorithms (RS256, ES256…) require a private key; generate one with the RSA Key Generator and sign with your server library.

How do I set an expiry relative to now?

Enter a number of minutes in "Set exp from now". The tool replaces the exp claim with the current time plus that duration and can also stamp iat with the current time.

How long should the secret be?

At least as long as the hash output: 32 bytes for HS256, 48 for HS384 and 64 for HS512 (RFC 7518 §3.2). Use the Random Secret Generator to create one; the tool warns when a secret is shorter.

Will the token work with my backend?

Yes, if the backend uses the same secret, algorithm and claim expectations (issuer, audience, expiry). The output follows RFC 7519 exactly and matches what libraries such as jsonwebtoken, PyJWT and jose produce for the same input.

Is my secret uploaded?

No. Signing happens in your browser with crypto.subtle; the secret and token never leave your device.

Technical notes

The header and payload are serialised as compact JSON, Base64url-encoded without padding and joined with a dot. The HMAC of that signing input is computed with crypto.subtle.sign and appended as the third segment, exactly as RFC 7515 describes. The alg value in the header is always set to the selected algorithm so the token stays consistent.