JWT Generator and Signer
Build a JSON Web Token in your browser. Choose an HMAC algorithm, edit the paylo...Build a JSON Web Token in your browser. Choose an HMAC algorithm, edit the payload, add claims and an expiry, and sign it with your secret. The compac...
Updated
Signing settings
Signed entirely in your browser with the Web Crypto API. Your secret and payload never leave the page, are never uploaded, and are gone when you close the tab.
A JWT payload is only Base64URL-encoded, not encrypted. Anyone can read it, so never put a password or an API key in a claim.
Quick answer
To generate a JWT, choose a signing algorithm (HS256, HS384, or HS512), type your secret, and write the payload as JSON. This tool Base64URL-encodes the header and payload, signs the header.payload string with your secret using the Web Crypto API, and shows the compact header.payload.signature token, all in your browser so nothing is uploaded. It updates live as you edit, has one-tap helpers to add the sub, iss, aud, iat, and nbf claims, and an expires-in picker that sets the exp and iat claims to the correct Unix epoch seconds. Copy the finished token, then paste it into the JWT Decoder to confirm the signature verifies with the same secret.
Generator Features
Why Use JWT Generator and Signer?
Live Signing as You Type
The compact token rebuilds the moment you change the payload, secret, or algorithm, so you always see the signed JWT without clicking a button.
Real HMAC Signatures
The signature is computed with the Web Crypto API using HS256, HS384, or HS512, so the token verifies correctly against your secret, not a fake placeholder.
Expiry in One Click
Pick a window like 1 hour or 7 days and the tool sets the exp and iat claims to the right epoch seconds for you, with a readable preview of when it lapses.
Editable Payload with Claim Helpers
Write any JSON payload by hand, or add sub, iss, aud, iat, and nbf with a tap. Invalid JSON gets a clear message instead of a crash.
Nothing Leaves Your Browser
Every token is built and signed on your device with JavaScript. Your secret and payload are never uploaded, logged, or stored, so it is safe for real keys.
Copy and Cross-Check
Copy the whole token, the header, or the payload with one click, then jump to the JWT Decoder to confirm the signature verifies with the same secret.
Common Uses for the JWT Generator
Test API Authentication
Create a signed token with the exact claims your API expects and send it as a Bearer header while developing.
Reproduce Auth Bugs
Build a token with a specific expiry or role to reproduce a 401 or a permission failure on purpose.
Seed Automated Tests
Generate deterministic tokens for integration and end-to-end tests that need a valid signed JWT.
Learn How Signing Works
See how a header and payload turn into a signed token to understand the JWT format from the inside.
How It Works
Pick the algorithm and secret
Choose HS256, HS384, or HS512, then type the shared secret the token will be signed with. HS256 is the most common choice.
Edit the payload and add claims
Write your claims as JSON, or use the helper buttons to add sub, iss, aud, iat, and nbf. Set an expiry with the duration picker.
Copy the signed token
The signed JWT updates live below the editor. Copy it and send it as an Authorization Bearer header, or decode it to double-check.
Tips and Security Notes
A JWT Is Not Encrypted
The payload is only Base64URL-encoded, so anyone with the token can read it. Never put a password, an API key, or other secrets in a claim.
Use a Strong Secret
For HS256, use a random string of at least 256 bits (32 characters). A short or guessable secret makes the signature easy to forge.
Sign Production Tokens Server-Side
Tokens built in a browser are ideal for testing. In production, sign on the server so the secret never ships in client code, and keep the expiry short.