JWT Generator
Sign and generate HS256 JSON Web Tokens
About JWT Generator
Signs a JSON payload with HS256 (HMAC-SHA256) using a secret you type and returns a compact JWT with its header, payload and signature color-coded. The header is fixed to alg HS256 and typ JWT, and the payload is signed exactly as written, so claims like iat or exp are never added for you. Useful for minting test tokens to call APIs or exercise middleware that validates HS256.
Category: API.
Frequently asked questions
What algorithms are supported?
▾
Only HS256, which is HMAC with SHA-256, so the header is always {"alg":"HS256","typ":"JWT"}. It's symmetric: the same secret signs and verifies the token. HS384, HS512 and asymmetric algorithms such as RS256 or ES256 aren't supported.
Is the secret used as plain text or Base64?
▾
As plain text: the UTF-8 bytes of what you type become the HMAC key, and an empty secret is rejected. If your backend Base64-decodes its secret before verifying, tokens generated here won't validate there. HS256 keys should be at least 32 bytes (256 bits) long.
What is the exp claim and how do I add it?
▾
The exp claim is the expiration time, a Unix timestamp in seconds on or after which the token must be rejected. Add it to the payload as a number, for example one from the Unix Timestamp converter, and always set it on tokens used for authentication.
Is it safe to generate tokens here?
▾
All signing runs in your browser using the Web Crypto API. Your secret never leaves your device. Still, treat generated tokens as development/testing tokens only.