JWT Generator
Sign a JWT with HS256 in your browser — custom claims, expiry and iat.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
Signs a JSON Web Token with HS256 entirely in your browser: paste a JSON payload, enter a secret, choose an expiry, and get a properly formed token — base64url segments without padding per the JWT spec, an iss-style header of {alg: HS256, typ: JWT}, and iat (issued-at) plus exp (expiry) claims added from your settings unless you supply your own. Signing uses the browser's WebCrypto HMAC-SHA256, the same primitive server runtimes use. The natural companion is the JWT Decoder on this site, which decodes and inspects what you just signed.
When to use it
Questions
Should I sign production secrets here?
No. The cryptography is real — WebCrypto HMAC is the same operation your server performs — but a production secret should never be pasted into any web page, this one included. Use this tool for test tokens with throwaway secrets, and sign real credentials inside your own stack.
Who can verify the token I generate?
Any verifier that knows the same secret and expects HS256. The signature is a standard HMAC-SHA256 over the first two segments, so jwt.verify in Node, PyJWT and every mainstream library accepts it unchanged.
Why does the token look like random characters instead of Base64?
JWTs use base64url: the URL-safe alphabet (- and _ instead of + and /) with padding stripped, because tokens end up in URLs, cookies and headers. It decodes back to bytes exactly like standard Base64.