JWT generator & signer

← All tools

Build and sign JSON Web Tokens with HMAC (HS256/HS384/HS512) using Web Crypto. For decode-only inspection use the JWT decoder. Secrets never leave the browser.

~~~
Warnings: HS256 secrets must be long and random (32+ bytes). Never put secrets or PII in the payload — it is only base64, not encrypted. RS256/ES256 need key pairs; use a proper library for asymmetric signing.
~~~

About this tool

JWTs carry signed JSON claims between services. The payload is base64url, not encrypted — anyone with the token can read it. HMAC algorithms (HS256/HS384/HS512) share one secret on both sides.

This tool signs and verifies symmetric tokens in the browser using Web Crypto. Add standard claims like exp, iat,sub, iss, and aud with one click. Verification checks the signature and whetherexp has passed.

Use this to debug auth flows or prototype tokens locally. Production apps should use established libraries, keep secrets out of logs, and prefer RS256/ES256 when many services verify the same token.

~~~

Read more