JWT Generator

About JWT generator

Builds and signs JSON Web Tokens with HMAC using SHA-256, SHA-384 or SHA-512. Edit the header and payload as JSON, add registered claims with helper buttons, pick an expiry, and get a signed token plus a readout of its time claims. Signing runs in the browser through WebCrypto, so the secret is not transmitted.

How to use it

1. Pick an Algorithm: HS256, HS384 or HS512. The alg header is set to match automatically.
2. Edit Header (JSON) and Payload (JSON). The Claim helpers buttons Add sub, Add iss, Add aud, Add nbf and Add jti insert registered claims for you.
3. Decide whether to Set iat to the moment of signing and Set exp relative to now, and choose 15 minutes, 1 hour, 1 day or 30 days.
4. Enter the Signing secret. The eye button shows or hides it.
5. Press Sign token, then copy the result. The three segments are shown separately, along with the decoded time claims.

A reproducible HS256 token

Header: {"typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Secret: your-256-bit-secret
Algorithm: HS256, with both Set iat and Set exp switched off

Three dot-separated parts. Part 1, the header: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. Part 2, the payload: eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ. Part 3, the HMAC-SHA256 signature: 43 base64url characters. The same inputs give the same token every time, because nothing in it is random or time-based once both time claims are off.

When to use it

• Producing a test bearer token for an API that authenticates with a shared HMAC secret.
• Checking that your backend's signing code matches a reference signature for the same header, payload and secret.
• Generating short-lived tokens with different exp values to test expiry handling.
• Showing a teammate how the three base64url segments relate to the JSON inside them.

Questions about JWT generator

Why only HS256, HS384 and HS512?

They use one shared secret, which can be handled entirely in the browser. RS and ES algorithms need private keys, and this tool deliberately does not handle key material of that kind.

What if my header contains a different alg?

It is replaced. The alg always matches the algorithm you selected, so the header and signature cannot disagree. The typ field defaults to JWT and any other header fields are kept.

Is my secret sent anywhere?

No. It is used only to derive a non-extractable HMAC key with WebCrypto inside your browser tab, and it is not stored. Even so, use throwaway secrets for testing rather than production keys.

Why did my iat value change?

With Set iat switched on, which is the default, the tool overwrites iat with the current time when signing, and Set exp does the same for exp. Turn the switches off to keep your own values, as in the example.

Are signed tokens encrypted?

No. The payload is only base64url-encoded, so anyone holding the token can read it. The signature shows that the contents were not altered by someone without the secret, so keep sensitive data out of claims.

Related tools

• HTML minifierMinify your HTML by removing all the unnecessary characters.
• CSS minifierMinify your CSS by removing all the unnecessary characters.
• JS minifierMinify your JS by removing all the unnecessary characters.
• JSON validator & beautifierValidate JSON content and make it looks good.
• SQL formatter/beautifierFormat & beautify your SQL code with ease.
• HTML entity converterEncode or decode HTML entities for any given input.