JWT Generator

Build & HMAC-sign a JSON Web Token (HS256/384/512).

Create a signed JSON Web Token from an editable header and payload: choose HS256, HS384 or HS512, add standard time claims (iat, exp, nbf) with one click, and sign it with your secret. The token is built and HMAC-signed entirely in your browser via the Web Crypto API — your secret never leaves your device.

How to use JWT Generator

  1. Edit the header

    Adjust the header JSON and pick a signing algorithm from the dropdown; this free online JWT generator writes the chosen alg into the header for you.

  2. Build the payload

    Type your claims into the editable payload JSON box, with live validation flagging any syntax error before the JSON Web Token is signed in your browser.

  3. Add standard claims

    Use the one-click buttons to insert time claims like iat now, exp in 1 hour, 24 hours or 7 days, nbf now, and a random jti identifier.

  4. Enter the secret

    Provide your HMAC signing secret, optionally marking it as Base64-encoded, since this shared secret is the only thing that stops the token being forged.

  5. Get the signed token

    The header.payload.signature JWT is built and signed live with HS256, HS384 or HS512 in the output box as soon as your inputs are valid.

  6. Copy or download

    Copy the signed JWT to your clipboard or download it as a .jwt file, ready to test an API, mock authentication or verify in the JWT Decoder.

Frequently asked questions

How do I create and sign a JWT?

Edit the header and payload JSON, choose an algorithm (HS256, HS384 or HS512), enter your secret, and the signed token is built live in the output box. Use the Add claim buttons to drop in standard time fields, then copy or download the finished header.payload.signature token.

Which signing algorithms are supported?

HS256, HS384 and HS512 — the HMAC family that signs with a single shared secret. They're the most common choice for service-to-service tokens and need no key files. Asymmetric algorithms (RS256, ES256, PS256) require a private/public key pair and aren't generated here.

How long should my secret be?

For HS256 use at least 256 bits (32 bytes); HS384 and HS512 want proportionally longer secrets. A short, guessable secret makes the token trivial to forge. Use a long random string — and the same secret on the server that verifies the token.

What's the “secret is Base64-encoded” option?

Some systems store the HMAC key as Base64 text. Tick the box if your secret is Base64 — the tool will decode it to the raw key bytes before signing, so the signature matches those systems. Leave it off to sign with the secret's literal UTF-8 bytes.

Can I verify the token I just made?

Yes — open the JWT Decoder, paste the token and enter the same secret. It will recompute the HMAC and confirm the signature is valid. The default example here uses the secret “your-256-bit-secret”, the same one the decoder loads.

Is anything sent to a server?

No. Encoding and HMAC signing run entirely in your browser with the Web Crypto API. Your header, payload and secret never leave your device.

Related tools — Developer · JWT tools