JWT Generator
Create and sign JSON Web Tokens with HMAC, RSA or ECDSA keys.
Sign A Token With Your Browser’s Own Cryptography
Write the payload as JSON, pick an algorithm and a key, and get a signed JSON Web Token, colour-coded into its header, payload and signature. HMAC tokens (HS256, HS384, HS512) take a shared secret; RSA (RS256, RS384, RS512) and ECDSA (ES256, ES384) tokens take a private key in PEM form — or generate a fresh key pair on the spot.
Signing uses WebCrypto, the same cryptography the browser uses for HTTPS, and every token is verified again before it is shown. One-click buttons set iat to now and exp an hour or a day ahead. Ideal for testing APIs and auth middleware — never paste a production signing key into any web page.
Key features
- HS, RS and ES algorithms — HS256/384/512, RS256/384/512, ES256/384.
- Key pairs on demand — generate RSA or EC keys and copy the public key for your verifier.
- Claim shortcuts — iat, exp +1 hour, exp +24 hours.
- Self-verified — every token is checked against its key before display.
- Offline and private — keys and payloads never leave the tab.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: JWT Generator
- Write the payload
Any JSON object; standard claims are sub, iat, exp, iss and aud. - Choose the algorithm
HS for a shared secret, RS or ES for a key pair. - Enter or generate a key
A long random secret, or a PEM private key. - Copy the token
Paste it into an Authorization: Bearer header to test your API.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Developer |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
What is the difference between HS256 and RS256?
HS256 signs and verifies with the same shared secret, so anyone who can verify can also forge. RS256 signs with a private key and verifies with the public key, so services that only check tokens never hold anything that can create them.
How long should an HS256 secret be?
At least 32 random bytes (256 bits). Short or dictionary-word secrets can be brute-forced offline from a single token, after which an attacker can sign any token they like.
Is a JWT encrypted?
No. A signed JWT is only base64url-encoded — anyone can read the payload. The signature proves it has not been changed; it does not hide anything. Never put passwords or secrets in a payload.
What do iat and exp mean?
iat (issued at) and exp (expiry) are Unix timestamps in seconds. Servers reject a token after exp, which limits how long a leaked token is useful.
How do I read an existing token?
Paste it into the JWT Decoder, which shows the header and payload and explains each claim.