JWT Token Generator
JWT Token Generator signs JSON header and claims objects with HS256 in your browser. Supply a text secret and copy the resulting Base64URL token.
JWT Token Generator signs JSON header and claims objects with HS256 in your browser. Supply a text secret and copy the resulting Base64URL token.
JWT Token Generator is a free JWT Tools utility that runs entirely in your browser — nothing you enter is uploaded.
How to use JWT Token Generator
- Enter a JSON object in Header and a JSON object in Payload.
- Supply the HMAC secret as text; the tool uses its UTF-8 bytes without decoding Base64 or hex.
- Choose Sign JWT. Only HS256 is supported; omitted alg and typ default to HS256 and JWT.
- Inspect the signed token, then choose Copy. Editing an input retires the previous result.
About this tool
Signs a JSON header object and JSON claims object with HS256 using the UTF-8 bytes of the supplied secret. Returns the compact token; arrays, null and scalar payloads are rejected. This signs data and does not validate application claims or encrypt the payload.
The supplied sample secret is for demonstration. Use an appropriately generated secret for a real application; HS256 requires a key of at least 256 bits. JSON numbers use JavaScript number representation, so store identifiers requiring exact large integers as strings. This tool does not implement arbitrary JOSE extensions or application authorization rules.
Frequently asked questions
What does JWT Token Generator produce?
A compact HS256 token from JSON header and payload objects and a text signing secret. Signing does not make the claims true or confidential.
What payload types are accepted?
The top-level payload must be a JSON object. Nested arrays and objects are allowed, but a top-level array, null, string, number or boolean is rejected.
How is the secret interpreted?
The secret is encoded as UTF-8 text exactly as supplied. A Base64 or hex-looking string is not automatically decoded into key bytes.
Does JWT Token Generator verify an existing token?
No. It signs new input. Use the JWT Validator with the matching secret for the supported HS256 signature check.
Which claims are validated?
This signer does not validate issuer, audience, expiration, issued-at policy or application permissions. Apply the receiving application’s validation rules separately.