JWT Generator
Sign JSON Web Tokens with HS256, HS384, or HS512. Set custom claims, expiry, and issuer — then copy the signed token for use in API testing or auth flows.
How to use the jwt generator
Paste a JSON payload, set a secret, pick an HMAC algorithm, and click Sign. The signed JWT appears below — three Base64URL parts separated by dots.
Formula & explanation
JWT = base64url(header) + '.' + base64url(payload) + '.' + HMAC-SHAxxx(header.payload, secret). HS256 = HMAC-SHA-256, HS384 = SHA-384, HS512 = SHA-512.
Examples
{"sub":"123"} signed with secret "my-secret" using HS256 → a 3-part token your auth library will accept.
Frequently asked questions
- Can I sign with RS256 (RSA)?
- Not yet — only HMAC family for now. RSA requires you to paste private keys, which is risky in a public web tool.
- Is my secret stored?
- No. Signing happens entirely in your browser via the Web Crypto API; nothing is uploaded.
Related developer tools tools
- JWT DecoderDecode JSON Web Tokens and inspect the header, payload, and signature. Paste any JWT to see claims, expiry, issuer, and algorithm — no secret key needed to decode.
- .gitignore GeneratorBuild a .gitignore file from community templates for any language or framework — Node, Python, Go, Java, React, Rails, and more. Select multiple templates and merge them in one click.
- JSON to TypeScriptGenerate TypeScript interfaces and types from any sample JSON. Handles nested objects, arrays, optional fields, and mixed types. Paste JSON, copy the interface.
- .htaccess GeneratorGenerate common Apache .htaccess snippets — redirects, URL rewrites, HTTPS enforcement, custom error pages, CORS headers, and caching rules. Copy the snippet you need.
- JSON FormatterPretty-print, minify, and validate JSON. Detects syntax errors with line numbers and supports nested structures of any depth.
- JSON DiffCompare two JSON values semantically. Ignores key order; shows added, removed, and changed fields with their JSONPath — great for diffing API responses and config files.