JWT Generator - Create & Sign JSON Web Tokens Online

Related Developer Tools

Base64 Encode/Decode Timestamp Converter QR Code Generator Lorem Ipsum Generator URL Encode/Decode Hash Generator Case Converter Word Counter Text Diff Color Picker UUID Generator Regex Tester JWT Decoder Markdown Preview HTML to Markdown Markdown to HTML YAML to JSON Cron Parser HTML Beautifier CSS Beautifier JavaScript Beautifier Password Generator SQL Formatter JSON to TypeScript Slug Generator Number Base Converter Chmod Calculator Escape/Unescape JSON Path Finder IP Address Tools Text to Binary HTML Entity Encoder Unicode Checker CSV Viewer XML Beautifier YAML Validator Remove Duplicates Base32 Encode/Decode String Length Text Reverse Hex Editor TOML Parser CSV to XML XML to CSV MD Table Generator Countdown Timer Random Number Random Picker Unit Converter ASCII Art Emoji Picker JSON to Go OG Preview HTTP Status Codes Regex Library CSS Gradient Box Shadow Favicon Generator HMAC Generator RSA Key Generator JSON to Rust JSON to Java JSON to Python AES Encrypt/Decrypt SHA-3 Hash TOTP Generator Password Checker Certificate Parser Excel to JSON SQL to CSV YAML Formatter Text to Speech Diff to Patch SVG Editor Crontab Generator Git Commands Docker Compose

What Is a JWT Generator?

A JWT (JSON Web Token) generator creates digitally signed tokens that securely transmit information between parties. JWTs consist of three Base64URL-encoded parts — header, payload, and signature — joined by dots. This tool generates HMAC-signed JWTs (HS256, HS384, HS512) entirely in your browser using the Web Crypto API.

How to Use

Edit the JSON payload with your claims (sub, name, exp, etc.).
Enter your secret key used to sign the token.
Select an HMAC algorithm: HS256, HS384, or HS512.
Click Generate Token to create the signed JWT.
Copy the token for use in your application or API testing.

Features

Supports HS256, HS384, and HS512 HMAC signing algorithms.
Color-coded token parts: header (red), payload (purple), signature (cyan).
Uses the Web Crypto API — no external libraries, runs in browser.
JSON payload validation with clear error messages.
No data is sent to any server — fully private and secure.

FAQ

What is the difference between HS256, HS384, and HS512?

All three use HMAC with a shared secret, differing only in hash length: SHA-256 (32 bytes), SHA-384 (48 bytes), SHA-512 (64 bytes). HS256 is the most common choice for most applications. Use HS512 when maximum signature strength is required.

What standard claims should I include?

Common claims include: sub (subject),iat (issued at, Unix timestamp),exp (expiry, Unix timestamp),iss (issuer), andaud (audience).

Is this safe to use with real secrets?

All signing happens locally in your browser using the Web Crypto API. No data is sent to any server. That said, avoid using real production secrets in any browser-based tool as a best practice.