Skip to content
TextArray1.41.0
100% local

JWT generator

Build and sign a JSON Web Token with HMAC, right in your browser.

Input
Output
Related tools
JWT decoderDeveloper tools
HMAC generatorDeveloper tools
Base64 encode and decodeEncoding & conversion
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
JWT generator
Paste a JSON payload and this tool builds a complete JSON Web Token: it assembles the header from your chosen algorithm, encodes the header and payload as Base64URL, and signs the result with HMAC. Use it to mint test tokens for an API, debug an auth flow, or see exactly what a given set of claims looks like once encoded.
Choose HS256, HS384 or HS512 and enter the secret key the token should be signed with — the same key your server will use to verify it. Quick-fill toggles add the common time claims without typing them by hand: "iat" stamps the token with the current time, "expires in" sets "exp" to now plus a chosen duration (from 15 minutes to 30 days, or none at all), and "nbf" marks the token as not valid until now. Separate fields set "sub" and "iss" when you need a subject or issuer claim. A quick-fill claim always overrides a same-named claim already in your JSON, so you can start from a template payload and let the toggles fill in the rest.
The payload can be pretty-printed or compact — pretty-printing only changes how the JSON is embedded, not what it decodes to. After signing, the tool decodes the token it just built and independently re-checks the signature with the Web Crypto API, so the tally line confirms the token actually verifies rather than just assuming it. Very large payloads are handled up to a 10 MB output cap, and the same secret and payload always produce the same token — nothing here depends on randomness.
Everything runs locally in your browser: the payload, the secret key and the signing itself never leave your device or touch a server. Copy the token, download it as a .txt file, or send it straight to the JWT decoder to inspect what you just built.
FAQ
Which algorithms are supported?
HS256, HS384 and HS512 — HMAC signing with SHA-256, SHA-384 or SHA-512. Asymmetric algorithms like RS256 or ES256 need a private key pair and aren't supported here.
What happens if I leave the payload empty?
An empty payload is treated as an empty JSON object. Combined with the quick-fill toggles you can still generate a token that only carries claims like "iat" and "exp".
Do the quick-fill claims overwrite what I typed?
Yes, by design: "iat", "exp", "nbf", "sub" and "iss" from the toggles and fields always take precedence over a same-named claim already in your JSON payload.
How is the signature verified?
After signing, the tool decodes the token it just produced and re-checks the signature independently with the browser's Web Crypto API, then reports the result in the tally line.
Is my secret key or payload uploaded anywhere?
No. The entire token is built and signed in your browser using the Web Crypto API — the secret key, the payload and the resulting token never leave your device, and the secret is never saved to local storage.