Private developer security tool

JWT Token Generator Online - No Signup

Generate HS256, HS384, or HS512 JWT tokens directly in your browser. Build claims, create a secure HMAC key, inspect the decoded result, and verify its signature without uploading your secret.

Generate JWT See how it works
HS256, HS384, and HS512 Local HMAC signing Signature verification No secret storage

JWT Token Generator

Configure the protected header, JSON payload, registered claims, and HMAC secret. Signing and verification happen locally through the Web Crypto API.

100% local signing

Signing configuration

HMAC algorithm written to the protected header.
Determines how the entered secret becomes bytes.
A secure random key is created on page load. Do not paste a production secret into an untrusted environment.
HS256 recommends at least 32 secret bytes.
The selected algorithm is enforced and cannot be overridden here.
Enter a JSON object. Do not include confidential information.

Registered claim helpers

Non-empty helper values override matching properties in the payload when the token is generated.
Separate multiple audiences with commas.

Press Ctrl/⌘ + Enter to generate and Esc to conceal the secret.

Use frontend JWT signing only for controlled development

This tool does not transmit your key, but production HMAC secrets should stay in protected backend infrastructure. Never embed a production signing secret in client-side JavaScript.

01
Local signing No JWT or secret uploads
02
Secure algorithms HS256, HS384, and HS512
03
Live verification Validate the HMAC signature locally
04
Decoded inspection Review header and payload JSON
Developer authentication tool

Create signed JWT tokens for development and testing

This JWT Generator creates compact JSON Web Tokens using HMAC SHA-256, SHA-384, or SHA-512. The header, payload, and signature are assembled according to the compact JWS representation used by common JWT libraries.

You can enter custom JSON claims, add registered claims such as iss, sub, aud, iat, exp, and jti, then verify the resulting signature with the same key.

JWT signing is not JWT encryption

The signature protects token integrity and authenticity when the verifier holds the correct key. It does not hide the protected header or payload, both of which remain readable after Base64url decoding.

Keep production signing keys on the server

Browser signing is useful for local development, API testing, demonstrations, and controlled debugging. Production systems should sign HMAC tokens in trusted backend infrastructure where the secret cannot be extracted by browser users.

Premium capabilities

Everything needed to generate and inspect a JWT

Build a signed token, review its exact decoded content, and verify the signature without an external runtime dependency.

Web Crypto HMAC signing

Generate signatures through the browser's native cryptographic API rather than a pseudo-random JavaScript implementation.

Editable JSON content

Define an additional protected header and payload while the selected algorithm remains securely enforced.

Registered claim helpers

Add issuer, subject, audience, issue time, expiration, and a cryptographically random JWT identifier.

Signature verification

Verify the generated token against the current secret and distinguish signature validity from expiration status.

Bounded decoded output

Long tokens and large JSON payloads remain inside independently scrollable panels instead of lengthening the page.

Copy and download

Copy the complete compact JWT or download it as a plain text file for a controlled development workflow.

Three simple steps

How to generate a signed JWT online

Configure the token, sign it locally, then inspect and verify the complete result.

Step 1

Configure header and claims

Select an HMAC algorithm, enter JSON data, and add the registered claims required by your test.

Step 2

Sign with an HMAC key

Use the generated random secret or enter a controlled development key in UTF-8 or Base64url form.

Step 3

Inspect and verify

Copy the compact token, inspect decoded JSON, and verify its cryptographic signature using the current secret.

Token anatomy

Understand the three parts of a signed JWT

A compact signed token contains three Base64url segments separated by periods.

Part 1 · Header

Protected header

Identifies the signing algorithm and normally includes the JWT token type.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Part 2 · Payload

Application claims

Contains registered and custom claims. This content is readable and must not be treated as encrypted.

eyJzdWIiOiJhY2NvdW50IiwiaWF0IjoxNzYwMDAwMDAwfQ
Part 3 · Signature

Integrity protection

Authenticates the encoded header and payload when verified with the correct HMAC key.

HMACSHA256(base64UrlHeader + "." + base64UrlPayload)
Security guidance

JWT implementation best practices

Token signing is only one part of a complete authorization and session-security design.

1

Pin the expected algorithm

Verifiers should enforce an allowlist instead of accepting an arbitrary algorithm from untrusted token data.

2

Validate required claims

Check issuer, audience, subject, expiration, and any application-specific authorization requirements.

3

Use strong secret material

Generate unpredictable keys with enough bytes for the chosen hash and rotate them through a controlled process.

4

Keep tokens short-lived

Use an expiration appropriate to the risk and implement refresh, revocation, and logout behavior where required.

Common questions

JWT Generator FAQ

What is a JSON Web Token?

A JSON Web Token is a compact string containing a protected header, a payload, and a signature. It is commonly used to transfer signed claims between applications.

Is the JWT payload encrypted?

No. A standard signed JWT payload is Base64url encoded, not encrypted, and can be read by anyone who receives the token. Do not place passwords, private keys, or other confidential information in it.

Are my JWT secret and token uploaded or stored?

No. This tool signs and verifies tokens locally in your browser and does not upload the secret or token, save them in cookies, or write them to local storage.

Which JWT algorithms does this generator support?

This generator supports HS256, HS384, and HS512 HMAC signing. It does not offer the insecure none algorithm or claim to create encrypted JWTs.

Should I use this JWT generator with a production secret?

Use it for development, testing, and controlled debugging. Production HMAC secrets should remain in protected backend infrastructure and should never be embedded in frontend code or shared with untrusted parties.

How are iat and exp values created?

The iat and exp claims use NumericDate values expressed as whole seconds since the Unix epoch. The expiration value is calculated from the current time and the duration you select.

Why does JWT signature verification fail?

Verification fails when the token, algorithm, secret bytes, or secret encoding does not match the original signing configuration. An expired token can still have a valid cryptographic signature.

Continue developing

Related developer and security tools

Decode tokens, transform Base64url data, or create unique identifiers for application claims.

Token inspection

JWT Decoder

Decode an existing JWT header and payload for local inspection and debugging.

Data encoding

Base64 Encoder & Decoder

Encode or decode text and inspect data used by development and integration workflows.

Identifiers

UUID Generator

Create unique identifiers for databases, APIs, events, and application records.

Ready to generate a signed JWT?

Create and verify an HS256, HS384, or HS512 JSON Web Token locally with editable claims and decoded inspection.

Generate JSON Web Token Now