JWT Generator

Create and sign JWTs with a custom payload and secret key.

Create signed JWT tokens with HMAC (HS256, HS384, HS512). All signing happens in your browser.

100% browser-side. No server. No data sent. Your secret never leaves your device.
For development and testing only. Do not use production secrets in the browser.

Supported alg: HS256, HS384, HS512

Add claim:

iat is set automatically to current time when you generate.

Shortcut: Ctrl+Enter or Cmd+Enter to generate

About JWT Generator

Create JWTs for development and testing. Use standard claims like sub, iat, exp, iss, aud. Signing uses the Web Crypto API in your browser—100% browser-side, no server, no data sent.

After generating a token, inspect claim timing and token structure in our JWT encoder decoder to validate header, payload, exp, nbf, and iat values before using it in your auth flow.

By Muhammad Abdullah Rauf · Founder, EverydayTools.proUpdated 2026

Workflow guides

Step-by-step chains that connect related tools for common tasks.

Generate a signed JWT for testing

  1. Select the signing algorithm (HS256, HS384, or HS512).
  2. Edit the payload JSON to include the claims you need (sub, exp, role, etc.).
  3. Enter your secret key in the signing key field.
  4. Click Generate — copy the resulting JWT for use in your API client or test suite.

Advertisement

Frequently Asked Questions

What is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe token composed of three Base64url-encoded sections: header (algorithm and type), payload (claims like user ID and expiration), and signature. The server signs the header+payload with a secret key; the client sends the JWT in subsequent requests and the server verifies the signature to confirm authenticity.

Which HMAC algorithm should I use — HS256, HS384, or HS512?

HS256 (HMAC-SHA256) is the most widely supported and sufficient for most applications. HS384 and HS512 produce larger signatures but are otherwise equivalent for symmetric signing. All three are browser-safe and use the Web Crypto API. If you need asymmetric signing (public/private key), use RS256 or ES256 instead — those are not supported in this tool.

Is my JWT secret exposed when using this tool?

No. Signing runs entirely in your browser using the Web Crypto API. Your secret key and payload never leave your device. Do not use real production secrets in any browser-based tool; use a dedicated key management system for production JWTs.

What is the difference between JWT and an API key?

An API key is a static opaque string — the server looks it up in a database to authenticate. A JWT is a self-contained token — the server verifies the signature without a database lookup. JWTs carry claims (user ID, roles, expiry) and expire automatically; API keys do not expire unless revoked.

Advertisement