Skip to content
AZ Tools

JWT Generator

Build and sign HS256 / HS384 / HS512 JWTs from a header and payload — pairs with the JWT Decoder.

Signed JWT
—

How to use

  1. Edit the header JSON if you need a non-default kid or typ.
  2. Edit the payload with the claims you want (sub, iat, exp …).
  3. Pick the HMAC algorithm.
  4. Enter the shared secret, then copy the resulting token.

About this tool

Show

Build a signed JSON Web Token from a header, a payload and a secret, with HS256, HS384 or HS512. Signing is done with the browser's own WebCrypto HMAC implementation, and the alg field in the header is set to match your choice so the token cannot end up claiming one algorithm while being signed with another. This is a tool for making test tokens: an expired one to check that your middleware rejects it, a token with a particular role claim, a fixture for an integration test. Because HMAC is symmetric, anyone holding the secret can mint valid tokens, so use a throwaway development secret here and never a production key — and remember nothing validates the claims you write, so exp and iat are just numbers until your server checks them.

Frequently asked questions

What algorithms are supported?

Symmetric HMAC algorithms: HS256, HS384, HS512. Asymmetric algorithms (RS256, ES256) aren't supported here because they require an RSA / EC key pair and a more involved key-management UX.

Is the secret stored?

Only in your browser's local storage so the tool remembers between visits. Nothing is sent to a server, including the secret. Treat the URL like any sensitive page — don't share screenshots.

Why does my token change when I add a property?

JWT signatures depend on the exact bytes of the header and payload after base64url encoding. Any change to whitespace, key order, or values changes the signature.

Are tokens always url-safe?

Yes — the encoder uses base64url (no +, /, or = padding), so the token can go in URLs, headers, or cookies without escaping.

Related tools

JWT Decoder

Decode a JSON Web Token to inspect its header, claims, and expiration.

Developer

PBKDF2 Key Derivation

Derive a key from a password with PBKDF2-HMAC in your browser — pick the hash, iteration count and output length, and read the result as hex or Base64.

Developer

Ed25519 Sign & Verify (RFC 8032)

Sign a message with an Ed25519 key or verify a signature in the browser, with the public key derived from the seed and R and S shown.

Developer

HMAC Generator (SHA-1 / 256 / 384 / 512)

Compute HMAC signatures with Web Crypto — sign webhook payloads, verify API requests, hex or base64 output.

Developer

JWK to PEM Converter (and back)

Turn a JWK or a whole JWKS into PEM public keys and back, with the RFC 7638 thumbprint for each — computed in your browser.

Developer

systemd Service File Generator

Build a .service unit file for systemd — Type, Restart, User, Environment, sandboxing — plus the install and journalctl commands.

Developer