JWT Generator Online
Create signed HS256 JWT tokens from a custom payload and secret key.
Algorithm: HS256 (HMAC-SHA256). Signing runs entirely in your browser.
When a JWT generator is the right tool
Use this page to create a compact JWT signed with HS256 from a JSON payload and a shared secret, entirely in the browser. It is for local tests and examples. It cannot mint RS256 or ES256 tokens, and it is the wrong place to use a production secret. To read a token back, use JWT Decoder or JWT Expiry Checker.
Use cases
Minting a test token for a local API
Keep or edit the default payload (sub, name, iat, exp), put the same HMAC secret your test server uses into the secret field, and click Generate JWT. Copy the three-part string into an Authorization header on your machine.
Fixing a stale default lifetime
If the tab has been open for a while, the prefilled iat and exp may already be in the past or closer than an hour. Update those Unix timestamps yourself before generating. The tool will not refresh them for you.
Seeing the three segments
The output colors the header, payload, and signature separately. The header is always the same HS256 JWT header; differences you type live in the payload.
How signing works
Generate parses the payload as JSON, builds the fixed header, base64url-encodes both with btoa (plus +// replaced and padding removed), then imports the secret as an HMAC SHA-256 key and signs header.payload. The signature is also base64url-encoded and appended. You have to click the button; editing the payload does not resign automatically.
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1763160000,
"exp": 1763163600
}
Header used automatically: {"alg":"HS256","typ":"JWT"}
Secret: your-256-bit-secret
Result: header.payload.signature (HS256 HMAC over the first two parts)The iat and exp values in that snippet are illustrative. On the page they depend on when the module first loaded.
What this tool does not do
It does not sign with RSA or ECDSA, encrypt a JWE, or verify an existing token. It does not keep the secret hidden, and it does not upload it. For expiry and standard claims on a token you already have, use JWT Expiry Checker.
How to use JWT Generator
- Edit the JSON payload. Adjust
iatandexpif you need a fresh window. - Enter the HMAC secret (visible in the text field).
- Click Generate JWT, then Copy when the token looks right.
Frequently asked questions
Which algorithms can I use?
Only HS256 (HMAC-SHA256). The header is always {"alg":"HS256","typ":"JWT"} — you cannot add a kid, switch to RS256 or ES256, or emit an alg of none. The secret is the HMAC key, encoded as UTF-8 bytes. Any length is accepted; the default string your-256-bit-secret is a placeholder, not a 256-bit key.
How do I generate a token?
Edit the JSON payload, enter a secret, and click Generate JWT. The output is not computed as you type. Invalid JSON shows “Invalid JSON payload — please check your syntax.” On success the token is shown in three colored segments (header, payload, signature) and can be copied.
Are iat and exp updated automatically?
No. The default payload is built once when the page module loads, with iat set to that moment and exp one hour later. Those numbers do not advance while the tab sits open, and clicking Generate does not rewrite them. Edit the payload if you need a fresh lifetime.
Can the payload contain Unicode, or be a JSON array?
The payload is passed through JSON.parse, so an object, array, or even a bare value will get past the “invalid JSON” check. The encoder then uses btoa on the JSON text. Characters outside Latin-1 (for example emoji or many CJK characters) can cause that step to fail. Stick to ASCII JSON if you want a reliable encode.
Is the secret or the token sent to a server?
No. Signing uses the Web Crypto API in your browser. The secret field is a plain text input, though, so it is visible on screen. Do not paste a production secret if you would not be comfortable with it sitting in memory and on the display. Closing the tab discards the form.