How to create and sign a JWT

Signing a JWT means base64url-encoding a header and a payload, then computing a signature over those two segments with a secret or private key. The result — header.payload.signature — is what your API expects in the Authorization header. Anyone can read the payload; only the key holder can produce a valid signature.

The two families matter: HMAC (HS256 and friends) uses one shared secret for signing and verifying, which suits monoliths. Asymmetric algorithms (RS256, ES256) sign with a private key and verify with a public one, which suits services that should verify tokens without being able to mint them. This tool does both, generates keys in-browser, and never sends your secrets anywhere. Decode the result with the JWT Decoder.

Open the free JWT Generator — no signup, runs entirely in your browser.

How to use it

  1. Pick the algorithm — HS256 for a shared secret, RS256 or ES256 for a key pair.
  2. Edit the header and payload JSON; the claims chips set iat and exp in seconds for you.
  3. Enter the secret (or generate/import a key pair) and copy the live-signed token.

Why this one

  • Live re-signing on every edit — no button, and stale output is clearly marked.
  • Secret encoding toggle (UTF-8 vs base64 key bytes) so tokens verify against jwt.io-style backends.
  • In-browser RSA and EC key generation with PKCS#8/SPKI PEM export and import.
  • The algorithm selector always wins over a pasted alg header, so alg:none tokens are impossible.

Frequently asked questions

Which JWT algorithm should I use?

HS256 when one service both issues and verifies tokens and can hold the secret. RS256 or ES256 when verifiers are third parties or many services — they get the public key only. ES256 produces much smaller signatures than RS256 and is the modern default.

Is it safe to generate a JWT with a real secret online?

Only when nothing leaves your machine — here, signing runs in WebCrypto inside your browser: secrets and private keys are never transmitted, stored, or put in the URL. Server-side generators would mean handing your signing key to a stranger.

Why are iat and exp plain numbers instead of dates?

JWT time claims are NumericDate values: seconds since the Unix epoch. Not milliseconds, not ISO strings — libraries reject or misread those. The claims chips insert correct integer-second values.