JWT Generator

Create and sign JSON Web Tokens locally. Pick an algorithm, edit the header and payload, and the token re-signs live as you type.

Algorithms

| Algorithm | Kind | Key |

|-----------|------|-----|

| HS256 / HS384 / HS512 | HMAC (shared secret) | Secret text or base64 key bytes |

| RS256 | RSA PKCS#1 v1.5, 2048-bit | Generated or imported PKCS#8 key pair |

| ES256 | ECDSA P-256 | Generated or imported PKCS#8 key pair |

Features

Live re-signing — the token updates (debounced) on every edit; invalid input marks the output as stale instead of showing a misleading token
Secret encoding toggle — HS* secrets can be raw UTF-8 text or base64/base64url key bytes, matching jwt.io, so tokens verify against backends that expect either
Weak-key warnings — HS* secrets shorter than the RFC 7518 minimum get flagged
Claims chips — one click sets iat to now or exp to +15m/+1h/+1d (integer seconds, per spec), or seeds iss/sub
Key management — generate RSA/EC key pairs in-browser, export PKCS#8 private + SPKI public PEM, or import an existing PKCS#8 PEM
alg is always honest — the selected algorithm overrides whatever alg/typ you pasted into the header, so alg: none is impossible

Claims to know

iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued at), nbf (not before), jti (token id). Time claims are NumericDate values: integer seconds since the Unix epoch — not milliseconds.

Privacy

Signing happens entirely in your browser with WebCrypto. Secrets and private keys are never transmitted, never stored, and never appear in URLs or analytics. Decode the result with the [JWT Decoder](/jwt-decoder).