JWT Generator and Signer

Signing happens in your browser. Your payload and secret are never sent.

What is JWT Generator and Signer

A JWT (JSON Web Token) packs a JSON payload, a header, and a signature into a compact token used for authentication and API access. This generator signs your payload with HMAC (HS256, HS384, or HS512) and a shared secret, producing a ready-to-use token. It runs entirely in your browser with the Web Crypto API, so your payload and secret never leave the page.

How to use

  1. Edit the JSON payload with the claims you want (sub, name, exp, and so on).
  2. Enter the signing secret shared with the verifier.
  3. Choose the algorithm (HS256 is the common default).
  4. Copy the signed JWT from the output box.

When to use it

Building or testing an auth flow and need a valid token to try against your API? Set the claims, enter your secret, and you get a signed JWT you can paste into a request or your JWT decoder to confirm it verifies. Developers use it to mock logins, reproduce token bugs, and check that a backend accepts the exact algorithm and secret they expect.

Frequently asked questions

Which algorithms are supported?

HMAC signing with HS256, HS384, and HS512, using a shared secret. RSA and ECDSA (RS/ES) are not supported here because they need a private key, which does not fit a client-side tool.

Is the token encrypted?

No. A signed JWT is not encrypted, only signed. Anyone can read the header and payload by Base64URL-decoding them. The signature proves it was not tampered with, so never put secrets in the payload.

Are my payload and secret sent anywhere?

No. The token is signed in your browser with the Web Crypto API. Nothing you enter is uploaded, logged, or stored. To read a token back, use the JWT decoder.

Related tools