JWT generator
Type a header, a payload and a secret, and get a signed JWT using HMAC-SHA256, SHA384 or SHA512. It is meant for testing and learning; the signing happens locally with the Web Crypto API.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Pick HS256, HS384 or HS512.
- Edit the header and payload JSON. Both must be objects.
- Enter the secret. The token updates as you type; copy it.
How it works
The header and payload are written as compact JSON, encoded as Base64URL without padding and joined with a dot. That string is signed with HMAC using the secret, and the Base64URL of the signature is added as the third part. The default example, with the secret your-256-bit-secret, produces a token ending in SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c.
Tips
- A JWT is signed, not encrypted: anyone can read the payload, so keep secrets out of it.
- HMAC secrets should be at least as long as the hash output (32 bytes for HS256).
- Add an
exp claim for real tokens so they stop working after a while.
Frequently asked questions
Which algorithms are supported?
HS256, HS384 and HS512, which are HMAC with SHA-256, SHA-384 and SHA-512. Asymmetric algorithms such as RS256 or ES256 need a private key and are not covered here.
Why does the header always show my chosen algorithm?
The alg value is set from the Algorithm choice so the header and the signature can never disagree. If you leave out typ, it is set to JWT.
Does the secret leave my browser?
No. The token is signed locally with the Web Crypto API and nothing is uploaded. Still, treat any secret you type into a web page as exposed and use throwaway secrets here.
What are the iat, exp and nbf claims?
They are registered claims from RFC 7519, given in seconds since 1 January 1970 UTC. iat is when the token was issued, exp when it expires and nbf the time before which it must not be accepted. The button sets iat to the current time.
How can I check the token I made?
Paste it into the JWT decoder to read the header and payload. To verify the signature, your server or library needs the same secret and algorithm.