Skip to content
Categories
JWT Generator
Generate a JWT from a header, payload, and secret.
Overview
- Generates a signed JWT (JSON Web Token) from a Header, Payload, and Secret (signing key) you specify.
- Supports HMAC-based signing algorithms (HS256, HS384, HS512), switching the signing method based on the alg value specified in the Header.
- Signing uses the Web Crypto API and happens entirely in your browser, so the Secret is never sent externally.
Usage
- Enter JSON data into the Header and Payload fields. Set the Header's alg to HS256, HS384, or HS512.
- Enter the secret key to sign with into Secret.
- Click the "Generate" button to display the signed JWT. Use the "Copy" button to copy it to the clipboard.
Example
Input
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"Taro"}
Secret: my-secretOutput
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IlRhcm8ifQ.xxxxx
Use Cases
- Issuing a test JWT on the spot with arbitrary claims (Payload) while implementing or debugging authentication
- Preparing multiple JWTs with different expiration (exp) or role claims to verify API authorization logic
- Generating a token signed with a known Secret for use in unit tests of JWT verification logic
FAQ
Is the Secret I enter sent anywhere?
No. Signing happens entirely in your browser using the Web Crypto API, and the Secret is never sent externally.
Can I use public-key algorithms such as RS256?
No. Only the HMAC-based algorithms HS256, HS384, and HS512 are currently supported.
Does the Header's alg match the actual signing algorithm used?
Yes. The token is signed with the algorithm specified in the Header's alg value. An error is shown if the value is not supported.
Notes
- Only the HMAC-based algorithms HS256, HS384, and HS512 are currently supported. Public-key algorithms such as RS256 are not supported.
- Do not enter a secret key that is actually used in production here. We recommend limiting use to testing and verification.
- Entering invalid JSON into the Header or Payload results in an error.
Related Tools
Validate a JWT's format, expiration, and signature.
Generate an HMAC from a message, secret, and algorithm.
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hash values from text.