Skip to content
DevLab

🪪 JWT Generator & Signer

Enter header, payload, and secret to produce a signed JWT entirely in your browser. Supports HS256 / HS384 / HS512 via Web Crypto API.

✅ 100% free, no signup, runs entirely in your browser

Header (Base64URL)
Payload (Base64URL)
Signature (Base64URL)

⚠️ Security Notes

• Secrets are processed entirely in your browser using Web Crypto API and are never sent to a server.

• Entering production secrets into web tools is generally not recommended. Use for testing, learning, and debugging.

• HS256 secrets should be at least 256 bits (32 bytes); HS512 should be at least 512 bits (64 bytes).

🔗 Related Tools

📖 How to Use

  1. 1
    Set algorithm and payload
    Choose HS256 / HS384 / HS512 and enter your JSON claims in the Payload field. Use the +iat / +exp buttons to add standard claims in one click.
  2. 2
    Enter or generate a secret
    Type a key into the Secret field, or click Random to generate a cryptographically secure 256-bit secret. Select UTF-8, Base64, or Base64URL input format.
  3. 3
    Copy the generated JWT
    The signed JWT appears instantly in the right panel. Click Copy to get it on your clipboard, ready for JWT decoder or API testing.

❓ FAQ

What is the difference between HS256, HS384, HS512?
All use HMAC signing; the number indicates the SHA hash length. HS256 is the most common; HS512 is preferred when higher security is needed.
Is it safe to enter a production secret here?
The secret is only used by Web Crypto API in your browser and never sent to any server. That said, entering production secrets into web tools is generally discouraged — use for testing only.
Is RS256 or ES256 (asymmetric) supported?
This tool supports HMAC-based algorithms (HS256 / HS384 / HS512) only. For RS256, ES256 and other asymmetric algorithms, use a dedicated library.
🐛 Found a bug or issue with this tool?

Free to use, no signup. Even just the steps to reproduce are helpful. Reports go directly to the operator and help us fix issues.

* Browser info (UA / screen / language / URL) is sent automatically to help reproduce the issue