JWT Generator

Create signed JSON Web Tokens (HS256, HS384, HS512) with custom headers, payloads, and expiry times. Signing happens entirely in your browser.

Signing happens locally in your browser. Your secret and token are never sent or stored.

How to generate a JWT

A JSON Web Token lets you prove that a payload was created by someone holding a shared secret. It has three parts — header, payload, and signature — joined by dots and base64url-encoded.

This tool builds and signs the token entirely in your browser using the Web Crypto API. Your secret and payload never leave the page.

Edit the header and payload

The header declares the algorithm and token type. The payload holds your claims — iss, sub, iat, exp, or anything custom. Both must be valid JSON or the token can't be built.

Choose algorithm and expiry

Pick HS256 for broad compatibility, or HS384/HS512 for longer digests. The expiry option adds an exp claim automatically: 15 minutes up to 30 days, or none if you set dates yourself.

Set a strong secret

The HMAC secret is what protects the token, so use a long random string — the Random secret button generates a cryptographically secure 32-byte value for you.

Generate and decode

Click Generate to create the signed token, copy it with one click, and check the decoded table below to verify exactly what was signed. Everything happens locally in your browser.

Frequently Asked Questions

What is a JSON Web Token (JWT)?+
A JWT is a compact, URL-safe format for carrying claims between two parties. It consists of a header, a payload, and an HMAC signature that proves the token was created with a shared secret.
Where is my secret used?+
Your secret never leaves your browser. The HMAC signature is computed locally with the Web Crypto API, and nothing — token, payload, or secret — is sent to any server.
Which algorithms are supported?+
HS256, HS384, and HS512 — HMAC signatures based on SHA-256, SHA-384, and SHA-512 respectively. These are the most widely supported symmetric JWT algorithms.
How does the expiry option work?+
When you pick an expiry, the tool automatically adds an exp (expiration time) claim to your payload, calculated from the moment you generate the token. Choose 'no expiry' to manage iat and exp yourself.
Can I use the generated token in production?+
You can — the structure and signature follow the JWT standard. Just make sure to use a long, random secret and never expose it in client-side code. For asymmetric signing (RS256), use a dedicated key-management setup.

Related Tools

JWT DecoderBase64 EncoderHash Generator

JWT Generator — free online jwt generator, json web token generator, create jwt online, hs256 token generator, jwt sign tool, generate jwt token, jwt builder, jwt creator online, hmac token generator, free jwt tool. No signup required. Works in your browser.