Generate a signed JWT (HS256) from a JSON payload and a secret key, computed entirely in your browser with our own SHA-256/HMAC implementation.
Google AdSense Banner
This area will contain advertisements after approval.
Google AdSense Banner
This area will contain advertisements after approval.
This tool builds a standard HS256 JWT: the header ({"alg":"HS256","typ":"JWT"}) and your payload are base64url-encoded and joined with a period, then signed with HMAC-SHA256 using your secret key. The signature is appended as a third base64url segment, producing a complete, verifiable token. Both the SHA-256 and HMAC logic are implemented directly in this tool, no crypto library involved, and verified to produce byte-identical output to standard implementations.
Anyone with your secret key can generate valid tokens that your server will accept, or verify tokens they intercept, so treat it like a password. This tool runs entirely in your browser and never transmits your secret anywhere, but you should still avoid using a real production secret in any external tool, use this for testing, prototyping, or generating tokens with throwaway secrets.
Signing the payload {"sub":"1234567890","name":"John Doe"} with the secret key 'your-secret-key' produces the header segment eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9, the payload segment eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0, and a computed HMAC-SHA256 signature joined with periods into a complete token. Change even one character of the secret and the entire signature segment comes out completely different, that's the point, only someone with the exact same secret can produce a matching signature for the same header and payload.
Using a real production secret key to generate a test token in any third-party tool, treat secrets like passwords, use a disposable throwaway value for testing and prototyping instead.
Expecting this to produce RS256 or other asymmetric-algorithm tokens, this generator only supports HS256 (a shared-secret HMAC scheme), asymmetric signing requires a private/public key pair and different tooling.
Entering payload JSON that isn't a flat object, like a bare array or a primitive value, a JWT payload must be a JSON object (even if it's simple), passing anything else will be rejected.
HS256 (HMAC with SHA-256) is symmetric, signing and verifying both use the same secret key, which is why it can be implemented and computed entirely client-side. Asymmetric algorithms like RS256 require a private/public key pair and are a separate, more involved implementation.
No, the entire signing process runs in your browser using JavaScript. Your secret and payload are never transmitted to or stored on our servers.
Yes, paste the generated token into our JWT Decoder to see its decoded header and payload. Full signature verification would require re-computing the HMAC with the same secret, which this decoder intentionally doesn't do since it never asks for a secret.
Google AdSense Banner
This area will contain advertisements after approval.