Generate a JWT
Enter a secret to sign the token.
Make a signed token to test an API, a middleware or an auth flow. Edit the claims, set an expiry, enter the shared secret and copy the token. The secret never leaves your browser.
- Free
- Runs in your browser
- HS256, HS384, HS512
- No sign-up
How It Works
Create a token in three steps.
Write the payload
Edit the JSON claims: subject, name, roles or anything your API reads.
Choose algorithm and secret
HS256 is the most common. Add iat and exp if your API checks them.
Copy the token
Send it in an Authorization: Bearer header.
How is a JWT signed?
A JSON Web Token is three Base64URL parts joined by dots: a header naming the algorithm, the payload with your claims, and a signature. With HS256 the signature is an HMAC-SHA256 of the first two parts using a shared secret, so anyone with the same secret can check the token was not changed. This generator builds the header, encodes the payload and signs it with your browser's Web Crypto API.
RS256 and ES256 tokens are signed with a private key instead of a shared secret and are not offered here. Never paste a production private key into a website.
Three HMAC algorithms
HS256, HS384 and HS512, using SHA-256, SHA-384 or SHA-512.
iat and exp helper
Adds the current Unix time as iat and an expiry a number of minutes ahead as exp.
Base64 secrets
Tick the option when your secret is stored Base64-encoded, as some frameworks do.
Secret stays local
Signing happens in your browser; the secret is never sent anywhere.
Convert PDF Files and File Formats
Find the perfect online tool to combine PDF files, compress documents, and handle your daily workflow effortlessly.
PDF Tools
All your PDF needs in one place
- Merge PDF
- Organize PDF
- Split PDF
- Compress PDF
- Convert to Word
- Convert to Image
Image Tools
Edit and optimize your images
- Resize Image
- Compress Image
- Convert Format
- Crop Image
- Add Watermark
- Remove Background
Word Tools
Work with Word documents
- Convert to PDF
- Merge Documents
- Split Documents
- Compress File
- Edit Text
- Add Watermark
Excel Tools
Process Excel spreadsheets
- Convert to PDF
- Convert to CSV
- Merge Sheets
- Split Sheets
- Compress File
- Clean Data
Why Use This JWT Generator
Test tokens without writing a script.
Edit any claim
The payload is plain JSON, so custom claims are easy.
Expiry in one click
iat and exp set from the current time.
Pairs with the decoder
Check the result with the JWT Decoder.
Private
Secrets stay in the browser.
Frequently Asked Questions
Questions people ask about the JWT Generator.
At least 32 random bytes. The JWT standard (RFC 7518) requires a key at least as long as the hash output: 256 bits for HS256, 384 for HS384 and 512 for HS512.
Common causes: a different secret, the secret treated as Base64 on one side and plain text on the other, a missing or expired exp, or a required claim such as aud or iss missing from the payload.
No. RS256 needs an RSA private key, which should stay on your server. This tool signs with shared secrets (HMAC) only.
Issued at and expiration time, both in Unix seconds. Many APIs reject a token whose exp has passed. Use Add iat and exp to set them.
Related Text & Developer Tools
More small utilities that run in your browser.
HMAC Generator
Sign a message with HMAC-SHA256 or SHA-512 and a secret key.
JWT Decoder
Read the header and payload of a JSON Web Token.
Base64 Encode & Decode
Encode text to Base64 or decode it back.
Unix Timestamp Converter
Convert Unix time to a date and back.
AES Encrypt & Decrypt
Encrypt text with a password using AES-256-GCM.