JWT Generator
Paste a JSON payload, enter a secret, and get a properly signed HS256 token: base64url segments with no padding, iat and exp claims set from your chosen expiry, signed with the WebCrypto API. The token never leaves the page, and the secret never leaves the page either. Inspect the result afterwards with the JWT Decoder. Runs entirely in your browser.
About this tool
Signs a JSON Web Token with HS256 entirely in your browser: paste a JSON payload, enter a secret, choose an expiry, and get a properly formed token — base64url segments without padding per the JWT spec, an iss-style header of {alg: HS256, typ: JWT}, and iat (issued-at) plus exp (expiry) claims added from your settings unless you supply your own. Signing uses the browser's WebCrypto HMAC-SHA256, the same primitive server runtimes use. The natural companion is the JWT Decoder on this site, which decodes and inspects what you just signed.
When to use it
Questions
Should I sign production secrets here?
No. The cryptography is real — WebCrypto HMAC is the same operation your server performs — but a production secret should never be pasted into any web page, this one included. Use this tool for test tokens with throwaway secrets, and sign real credentials inside your own stack.
Who can verify the token I generate?
Any verifier that knows the same secret and expects HS256. The signature is a standard HMAC-SHA256 over the first two segments, so jwt.verify in Node, PyJWT and every mainstream library accepts it unchanged.
Why does the token look like random characters instead of Base64?
JWTs use base64url: the URL-safe alphabet (- and _ instead of + and /) with padding stripped, because tokens end up in URLs, cookies and headers. It decodes back to bytes exactly like standard Base64.