JWT Generator
API & BackendSign HS256, HS384 or HS512 JSON Web Tokens from a payload and secret.
Runs entirely in your browser — nothing is uploaded
What people do next
Features
- HMAC signing with SHA-256, SHA-384 or SHA-512.
- Registered-claim helpers for iss, sub, aud, exp and iat.
- Live preview of the encoded header and payload segments.
- Signing happens locally with the Web Crypto API.
How to use the JWT Generator
- 1Edit the payload and add any registered claims you need.
- 2Enter your signing secret and choose an algorithm.
- 3Copy the signed token.
Frequently asked questions
Is it safe to enter my production secret?
Signing runs entirely in your browser and the secret is never transmitted, but use a development secret wherever you can.
Can it sign RS256?
Not currently. RS256 needs an RSA private key; this tool covers the HMAC family only.
What makes a good signing secret?
For HMAC algorithms, at least as many random bytes as the hash output, so 32 for HS256. A short or guessable secret can be brute-forced offline by anyone holding a single token, which then lets them mint their own. Generate it randomly and store it where your application code can read it and nothing else can.
How long should a token live?
Short, because a JWT usually cannot be revoked. Anyone holding it can act as the subject until it expires, so minutes to hours is typical for an access token, with a separate refresh token doing the long-lived work. Setting a long expiry to avoid handling refresh is a trade that stays invisible until it is not.