JWT Generator
Create and sign JSON Web Tokens using HS256, RS256, or ES256
Keep this secret in production — never expose it client-side
About this tool
The JWT Generator creates signed JSON Web Tokens directly in your browser using the WebCrypto API. Enter custom claims (payload) and sign with HS256 (a shared secret), or switch to RS256/ES256 and either paste an existing PKCS8 private key or generate a fresh RSA/EC key pair on the spot — the matching public key is shown alongside for verification. Nothing is sent to any server.
When to use it
- →Generating test tokens for local API development without running auth servers
- →Creating JWTs with specific expiry and claims for manual integration testing
- →Learning JWT structure by experimenting with header, payload, and signature
- →Mocking authentication flows in frontend prototypes
Tips
- ◆Always include exp (expiry) and iat (issued-at) claims — most JWT libraries reject tokens without them.
- ◆The secret key strength is critical: use at least 256 bits (32 bytes) of random data for HS256.
- ◆Never use the same secret in production as in testing — rotate keys when moving between environments.
- ◆Switching to RS256 or ES256 but don't have a key handy? Click 'Generate key pair' — it creates a fresh RSA-2048 or P-256 key on the spot and shows the matching public key for verification.
Frequently asked questions
Is my secret key or private key safe when using this tool?
Yes. The JWT is signed entirely in your browser using the WebCrypto API. Your secret key or private key and payload never leave your device — there is no network request, whether you paste an existing key or generate one in-tool.
What is the difference between HS256 and RS256?
HS256 uses a single shared secret for both signing and verification (symmetric). RS256 uses a private key to sign and a public key to verify (asymmetric), which is safer when the verifier is a different party from the signer.
Why does my JWT have three dot-separated parts?
A JWT consists of three base64url-encoded parts: the header (algorithm and token type), the payload (claims), and the signature. They are concatenated with dots: header.payload.signature.
Can I use this JWT in production?
You can use the format, but never hardcode secrets generated or tested here in production systems. Always load secrets from environment variables or a secrets manager.