AZ Tools

JWT Generator

Developer

Edit the JSON header and payload, pick an HMAC algorithm (HS256, HS384, HS512), set a secret, and the tool produces a signed JWT live. Signing uses the browser's Web Crypto API, so the secret and payload never leave your device. Useful for quickly testing endpoints that expect specific claims, simulating expired tokens, or generating fixtures for tests.

Signed JWT

How to use

  1. Edit the header JSON if you need a non-default kid or typ.
  2. Edit the payload with the claims you want (sub, iat, exp …).
  3. Pick the HMAC algorithm.
  4. Enter the shared secret, then copy the resulting token.

Frequently asked questions

What algorithms are supported?
Symmetric HMAC algorithms: HS256, HS384, HS512. Asymmetric algorithms (RS256, ES256) aren't supported here because they require an RSA / EC key pair and a more involved key-management UX.
Is the secret stored?
Only in your browser's local storage so the tool remembers between visits. Nothing is sent to a server, including the secret. Treat the URL like any sensitive page — don't share screenshots.
Why does my token change when I add a property?
JWT signatures depend on the exact bytes of the header and payload after base64url encoding. Any change to whitespace, key order, or values changes the signature.
Are tokens always url-safe?
Yes — the encoder uses base64url (no +, /, or = padding), so the token can go in URLs, headers, or cookies without escaping.

Related tools