JWT Generator
Runs in your browserEdit the claims, pick an algorithm and a secret. The token re-signs as you type.
Header
alg is always set from the menu, so the header can’t disagree with the signature.
Payload
Token
Signing…
How this one works
The header and payload are serialised as compact JSON, Base64URL-encoded and joined with a dot. That string is signed with HMAC using the secret and algorithm you choose, via the browser’s WebCrypto, and the signature is appended as the third part.
The quick buttons write iat and exp as seconds from now, which is what JWT libraries expect. Open the result in the decoder to inspect it — the token and secret carry over.
Questions
- What should I use generated tokens for?
- Local development and tests: fixtures for an API that expects a bearer token, reproducing a bug with specific claims, or checking how your code handles an expired token.
- Why only HS256, HS384 and HS512?
- Those use a shared secret, which is simple to type. RS and ES algorithms need a private key in PEM or JWK form; they may arrive in a later tool.
- Is the secret stored anywhere?
- No. It lives in this page’s memory while the tab is open and is never written to storage or sent over the network.