JWT Generator (HS256/384/512)
Create a signed HMAC JWT from a JSON payload and secret — runs 100% in your browser, nothing is uploaded.
🔒 Payload and secret are signed in your browser — nothing is uploaded. For testing/development only; never paste a production secret.
What this JWT generator does
This tool builds a signed JSON Web Token (JWT) from a JSON payload, a secret, and an HMAC algorithm (HS256, HS384, or HS512). It base64url-encodes a fixed header of {"alg":"…","typ":"JWT"} and your payload, joins them with a dot, and signs that string using the Web Crypto HMAC API. The resulting compact token has three parts — header, payload, and signature — separated by dots, exactly like the tokens issued by real authentication servers.
When to use it
It is handy for testing and development: mock an API that expects a Bearer token, seed a local test suite, or explore how the header and payload map onto the encoded segments. Because it uses symmetric HMAC signing, anyone with the same secret can both sign and verify the token, so keep it to non-production secrets. For production you should generate tokens on your server where the secret never leaves your control.
Frequently asked questions
Is my payload or secret uploaded anywhere?
No. Everything happens locally with the Web Crypto API in your browser. Your payload and secret are never sent to a server, logged, or stored.
Which algorithms are supported?
HMAC-based HS256, HS384, and HS512. The chosen algorithm is written into the token header as the alg field and used to sign the header-and-payload string.
Can I use these tokens in production?
It is meant for testing and development. Anyone who knows the secret can forge valid tokens, so only use throwaway secrets here and issue real tokens from your backend.