JWT Generator
Create an HS256-signed JWT from a JSON payload and testing secret locally.
This tool runs entirely in your browser. Your files are never uploaded to a server.
Creates an HS256 signature locally. Use short-lived secrets only for testing; do not paste production credentials into browser tools.
What this tool does
Creates a compact JSON Web Token with a fixed HS256 header, your JSON object payload and an HMAC-SHA-256 signature.
How to use it
Enter a valid JSON object and a non-empty secret. Web Crypto signs the header.payload bytes and the copy button exposes the resulting three-part token.
Example
A payload containing sub, name and iat becomes Base64url header and payload segments followed by a signature tied to the supplied secret.
Validation
The payload must parse as a JSON object rather than an array or scalar. Invalid JSON and an empty secret prevent token generation.
How to interpret the result
A valid signature proves knowledge of the shared secret; it does not encrypt claims. Anyone holding the token can decode header and payload.
Limitations
Only HS256 is supported. The tool does not verify claims, add exp automatically, rotate keys or replace production identity infrastructure.
Privacy
All processing uses local browser APIs and this tool does not upload the values you enter.
Frequently Asked Questions
- What does JWT Generator do?
- Creates a compact JSON Web Token with a fixed HS256 header, your JSON object payload and an HMAC-SHA-256 signature.
- How does it handle invalid input?
- The payload must parse as a JSON object rather than an array or scalar. Invalid JSON and an empty secret prevent token generation.
- Is entered data uploaded?
- All processing uses local browser APIs and this tool does not upload the values you enter.