Skip to content
Page Utils

JWT Token Generator

A JWT token generator creates and signs a compact HS256 JWT (JWS) in your browser. Edit the JSON payload, paste a labelled FAKE sample secret or your own test secret, then Generate and Copy with Web Crypto. Keys stay in tab memory — never localStorage or uploaded. Not a jwt.io decoder, JWE encryptor, or signature verifier.

Updated

Paste or edit a JSON payload, optionally apply standard claims (iss/sub/aud/exp/iat), then sign with HS256 using a secret that stays in this tab. Load example fills a labelled FAKE sample secret — never use that value in production. Closing the tab drops the secret and the token; we do not write them to localStorage.

This generator creates compact JWS only. For decrypting five-part compact JWE, use JWT Token Decrypt on this hub. For inspecting or verifying an arbitrary signed JWT like jwt.io, use a dedicated debugger — this page does not decode foreign tokens.

JWT (HS256) generator

Ad-light · in-browser only

JSON object claims for the JWT payload. Compact form is minified when signed. Standard claims (iss/sub/aud/exp/iat/nbf) are optional helpers below.

Standard claim helpers

Also sets iat to now when applied.

UTF-8 HMAC secret for HS256. Labelled FAKE sample only by default. Kept in tab memory — never localStorage, never uploaded.

FAKE sample secret only — never use this value in production.

How does the JWT Token Generator work?

  1. 1. Edit the JSON payload

    Paste claims as a JSON object, or press Load example. Optional helpers can set iss, sub, aud, iat, and exp (minutes from now) into the payload editor.

  2. 2. Paste an HS256 secret

    Use the labelled FAKE sample secret for a dry run, or paste your own test secret. Secrets stay in React state for this tab only — never localStorage, never uploaded.

  3. 3. Generate in the browser

    Press Generate. The tab builds a compact JWS header.payload.signature with Web Crypto HMAC-SHA256 (alg: HS256). Nothing is posted to Page Utils.

  4. 4. Copy the token

    Copy the compact token when you need it in a draft or local test. Close the tab to drop the secret. Need to unwrap encrypted JWE instead? Use JWT Token Decrypt on this hub.

Questions about JWT Token Generator

What does this JWT Token Generator do?
It creates and signs a compact HS256 JWT (three-part JWS) entirely in your browser. You edit a JSON payload, provide an HMAC secret, and get a token you can copy. Secrets and payloads stay in this tab — no signup and no upload.
Is this a jwt.io clone or JWT decoder?
No. jwt.io is built around inspecting and verifying signed JWTs. This page only generates and signs compact HS256 tokens. It does not decode or verify arbitrary JWTs you paste from elsewhere. JWT Token Decrypt on this hub unwraps compact JWE (five parts) and also refuses to act as a jwt.io-style debugger.
Does my secret leave the browser?
No. Signing uses the Web Crypto API in this page. Secrets are kept in memory for the tab session — they are never written to localStorage, never posted to Page Utils, and never uploaded as a file. This page stays ad-light: it does not include an advertisement slot. Close the tab to drop the material.
Which algorithm does it support?
HS256 only (HMAC-SHA256) via Web Crypto. That covers the most common local test and demo case. RS256, ES256, and other asymmetric algs are not offered here — keep those in your own app or CLI when you need private-key signing.
Why is there no /jwt-generator/ or /json-web-token-generator/ second URL?
One canonical address with a trailing slash: /developer/jwt-token-generator/. Queries like "jwt token generator", "generate jwt token", or "jwt generator" can land here. We do not publish stub alias slugs that would split the address people and search engines should share.
How is this different from JWT Token Decrypt?
JWT Token Decrypt unwraps compact JWE (five-part encrypted tokens). JWT Token Generator creates and signs compact JWS (three-part HS256 tokens). They share the same privacy rule (local only, ad-light) but solve opposite jobs — this page does not decrypt JWE, and the decrypt page does not mint tokens.
What is the FAKE sample secret?
A labelled demo string so you can try Generate without inventing a key. It is not a production secret and must never be used to protect real APIs or user data. Never paste real production keys into screenshots, and never reuse the sample outside this dry-run tab.
Can I set exp, iat, iss, sub, and aud?
Yes. Edit them directly in the JSON payload, or use the standard claim helpers (iss/sub/aud plus exp minutes from now, which also sets iat). nbf can be added manually in the JSON editor. Claims are not validated against a remote IdP — this is a local token builder.

What else can I open?

These tools run in your browser. Page Utils does not store, upload, or write to localStorage the keys, tokens, or text you paste. Results are a convenience aid, not legal, tax, or security advice.