Runs 100% in your browser — nothing is uploaded
Crypto, Hashing & Security

JWT Generator

Sign a JWT with HS256/384/512, a custom payload, expiry, issuer, and subject — right in your browser.

JWT Generator
Client-side

About this tool

The JWT Generator builds and signs a JSON Web Token using HMAC-based algorithms (HS256, HS384, or HS512), giving you a working token to paste into an Authorization header, a Postman request, or a test fixture without spinning up a backend. Enter a secret key, a JSON payload, and optional claims, and get back a fully signed, three-part JWT along with a decoded preview of its header and payload so you can verify exactly what was encoded.

Signing uses jose, a modern, spec-compliant JOSE (JSON Object Signing and Encryption) library built on the Web Crypto API — the same underlying cryptographic primitives browsers use for TLS. You can set an expiry from a dropdown (1 hour, 24 hours, 7 days, 30 days, or no expiry) which is translated into the standard exp claim, along with optional issuer (iss) and subject (sub) claims. The payload textarea accepts any JSON object; it's validated before signing so a typo produces a clear parse error instead of a broken token.

This tool exists for development and testing convenience: mocking an authenticated API request, testing a JWT-verification middleware with a known secret, or exploring how JWT claims and signatures work without external tooling. It is explicitly not meant for production authentication — the token is generated client-side with a secret you typed into a web page, which is fine for local development and testing but is never appropriate for issuing real user credentials.

Everything runs in your browser using jose's Web Crypto-backed signing — no request is made and no secret or payload is transmitted anywhere.

FAQ

Is it safe to use a JWT generated by this tool in production?
No. This tool is for development, testing, and learning — generating a mock token to test an API client or verification middleware. Never use browser-generated tokens or hand-typed secrets for real user authentication; production JWTs must be signed server-side with a securely managed secret or private key.
What is the difference between HS256, HS384, and HS512?
All three are HMAC-based signing algorithms using SHA-256, SHA-384, or SHA-512 respectively as the underlying hash. They differ only in the hash function's output size and computational cost — HS256 is the most common default, while HS384/HS512 offer larger signatures for marginally increased security margin.
What does the expiry dropdown actually set?
It sets the standard exp (expiration time) claim in the JWT payload, computed as the current time plus your selected duration, expressed as a Unix timestamp. A verifier checking exp against the current time will reject the token once that time has passed.
Can I add custom claims beyond issuer and subject?
Yes — anything you put in the Payload JSON textarea becomes part of the token's claims. Issuer and Subject are provided as separate convenience fields because they're extremely common, but you can include any additional custom key-value pairs directly in the JSON payload.
Why does the tool show a decoded preview after generating?
To let you immediately verify the token was built correctly — confirming the algorithm in the header and the exact claims (including the computed exp, iss, and sub) in the payload — without needing to paste the token into a separate decoder tool.