Which algorithms are supported?

HMAC-based signing with HS256, HS384 and HS512, which are the most common symmetric JWT algorithms.

Is it safe to enter my secret here?

The secret is used only in your browser to sign the token and is never uploaded. Still, avoid pasting real production secrets into any online tool.

How is this different from the JWT decoder?

This tool creates and signs a new token, while the JWT decoder reads an existing token's header and payload.

Security & Cryptography

JWT Generator

Create a signed JSON Web Token with HMAC (HS256/384/512).

Free browser toolRuns in your browserNo sign-up

Algorithm

Secret

Payload (JSON)

Tokens are signed in your browser with Web Crypto (HMAC). Your secret and payload are never uploaded. Use a long, random secret in production.

100% private - runs entirely in your browser.

Your input, keys and passwords are never uploaded. Want proof? Load this page, then turn off your internet - the tool still works. For an exact check, open your browser's DevTools Network tab and confirm no data is sent when you use it.

About the JWT Generator

A JSON Web Token packs a set of claims into a signed, URL-safe string that services can trust once they verify the signature.

Choose an HMAC algorithm, enter your JSON payload and a secret, and this tool builds and signs the token using your browser's Web Crypto.

Your secret and payload never leave your device, which is important because the secret can create valid tokens.

Key features

HMAC signing: HS256, HS384, HS512
Your own JSON payload
Signed locally with Web Crypto
Copy the token in one click

How to use

1Pick an algorithm and enter a secret.
2Edit the JSON payload as needed.
3Click Generate token and copy the result.

Examples

Sign an HS256 token

Input: Header alg HS256, payload sub 123, and a secret

Output: A three-part signed JWT

Keep real signing secrets private and verify tokens on a trusted server.

Frequently asked questions

Which algorithms are supported?: HMAC-based signing with HS256, HS384 and HS512, which are the most common symmetric JWT algorithms.
Is it safe to enter my secret here?: The secret is used only in your browser to sign the token and is never uploaded. Still, avoid pasting real production secrets into any online tool.
How is this different from the JWT decoder?: This tool creates and signs a new token, while the JWT decoder reads an existing token's header and payload.

Open a related tool to prepare your files or refine the finished result.