JWT Generator and Signer
Signing happens in your browser. Your payload and secret are never sent.
What is JWT Generator and Signer
A JWT (JSON Web Token) packs a JSON payload, a header, and a signature into a compact token used for authentication and API access. This generator signs your payload with HMAC (HS256, HS384, or HS512) and a shared secret, producing a ready-to-use token. It runs entirely in your browser with the Web Crypto API, so your payload and secret never leave the page.
How to use
- Edit the JSON payload with the claims you want (sub, name, exp, and so on).
- Enter the signing secret shared with the verifier.
- Choose the algorithm (HS256 is the common default).
- Copy the signed JWT from the output box.
When to use it
Building or testing an auth flow and need a valid token to try against your API? Set the claims, enter your secret, and you get a signed JWT you can paste into a request or your JWT decoder to confirm it verifies. Developers use it to mock logins, reproduce token bugs, and check that a backend accepts the exact algorithm and secret they expect.
Frequently asked questions
Which algorithms are supported?
HMAC signing with HS256, HS384, and HS512, using a shared secret. RSA and ECDSA (RS/ES) are not supported here because they need a private key, which does not fit a client-side tool.
Is the token encrypted?
No. A signed JWT is not encrypted, only signed. Anyone can read the header and payload by Base64URL-decoding them. The signature proves it was not tampered with, so never put secrets in the payload.
Are my payload and secret sent anywhere?
No. The token is signed in your browser with the Web Crypto API. Nothing you enter is uploaded, logged, or stored. To read a token back, use the JWT decoder.
Related tools
JWT Decoder
Decode any JWT instantly in your browser. View the header, payload and signature with readable expiry dates. Free, private JWT decoder.
AES Text Decryption
Decrypt AES-256 encrypted text with your password in your browser. Free, private, and fully offline. No data leaves your device.
AES Text Encryption
Encrypt text with a password using AES-256 in your browser. Free, private, and fully offline. Nothing is sent to a server.