About the JWT Generator
This JWT generator builds a signed JSON Web Token from a payload you write in JSON. It creates the header, base64url-encodes header and payload, computes an HMAC signature with your secret (HS256 or HS512), and joins the three parts into the compact token you can paste into an Authorization: Bearer header. Optionally it fills in the iat and exp claims from a date, time and lifetime so you can mint tokens that expire exactly when you want.
It is meant for developers testing APIs, writing integration tests, reproducing auth bugs or learning how JWTs work — for example creating an expired token to check that your server returns 401, or a token with an extra role claim to test authorisation rules. Everything runs in your browser; neither the secret nor the payload is sent anywhere.
Use test secrets only. A token signed here is a real credential for any system that trusts the same secret, so never paste a production signing key into a web page. RSA and ECDSA algorithms (RS256, ES256) need a private key and are not generated here; HMAC algorithms use a shared secret, and RFC 7518 requires that secret to be at least as long as the hash output (32 bytes for HS256, 64 bytes for HS512).
How to use the jwt generator
- 1Write the claims you need as a JSON object (sub, name, role, aud…).
- 2Enter a test secret and choose HS256 or HS512.
- 3Optionally add a kid header, or switch on "Set iat and exp" and choose the issue time and lifetime.
- 4Copy the signed token and send it as Authorization: Bearer <token>.
- 5Check the secret-strength warning — use at least 32 random bytes for HS256.
Formula and method
The header {"alg":"HS256","typ":"JWT"} and your payload are serialised as compact JSON (no spaces, keys in the order you wrote them), UTF-8 encoded and base64url-encoded — standard Base64 with "-" and "_" instead of "+" and "/" and no "=" padding. Those two strings joined by a dot form the signing input.
For HS256 the signature is HMAC-SHA256 of the signing input keyed with your secret (HS512 uses HMAC-SHA512), base64url-encoded and appended after a second dot. When "Set iat and exp" is on, iat is the chosen UTC date-time as Unix seconds and exp = iat + lifetime × 3600. Because the JSON is re-serialised compactly, whitespace in your payload does not change the token, but key order does.
- B64URL
- base64url encoding without padding (RFC 4648 §5)
- HMAC
- Keyed hash (RFC 2104) using SHA-256 or SHA-512
- iat / exp
- Issued-at and expiry times in Unix seconds (RFC 7519)
Worked examples
The classic jwt.io sample token
The payload {"sub":"1234567890","name":"John Doe","iat":1516239022} signed with HS256 and the secret "your-256-bit-secret" reproduces the well-known sample token from jwt.io, ending in SflKxwRJ…w5c. The secret is only 19 bytes (152 bits), so the tool warns that it is shorter than the 256 bits RFC 7518 requires.
One-hour API token issued 1 Jan 2026
With "Set iat and exp" on, iat becomes 1767225600 (2026-01-01 00:00 UTC) and exp is 3,600 seconds later, 1767229200. The 33-byte secret gives 264 bits, which satisfies the HS256 minimum, and the HMAC-SHA256 signature is wTeHqwkX…cFmM.
HS512 token with a key ID
Choosing HS512 and a kid of "key-1" changes the header to {"alg":"HS512","typ":"JWT","kid":"key-1"}. A 64-byte secret meets the 512-bit minimum, and the HMAC-SHA512 signature is 64 bytes, which base64url-encodes to 86 characters.
Frequently asked questions
How do I create a JWT token?+
Encode the JSON header and payload with base64url, join them with a dot, compute an HMAC (HS256) or RSA/ECDSA signature over that string with your key, base64url-encode the signature and append it after a second dot. This tool does those steps for HMAC algorithms.
How long should an HS256 secret be?+
RFC 7518 requires an HMAC key at least as long as the hash output: 256 bits (32 bytes) for HS256 and 512 bits (64 bytes) for HS512. Use random bytes from a secure generator rather than a memorable phrase.
Why does my token differ from another tool’s for the same payload?+
The signature covers the exact bytes of the encoded header and payload. Different key order, extra spaces, a different header (for example missing "typ" or an added "kid") or a differently encoded secret all change the token, even if the claims look the same.
Is it safe to generate JWTs in the browser?+
This page computes everything locally and sends nothing to a server. Even so, only use test secrets: anyone with the signing secret can mint valid tokens for every system that trusts it.
Can I generate RS256 or ES256 tokens here?+
No. Asymmetric algorithms need a private key and a signature library; in Node.js use jose or jsonwebtoken, or in Python use PyJWT with the cryptography package. This tool covers the HMAC algorithms HS256 and HS512.
What is the "none" algorithm for?+
alg "none" produces an unsigned token with an empty signature. It exists in the spec but servers must reject it in production; it is offered here so you can test that your API refuses unsigned tokens.