JWT Generator
Sign JWT with HS256/HS384/HS512, decode tokens, edit header/payload, claim presets (iat/exp/iss/aud/jti), Web Crypto API. 100% offline.
About this tool
A complete JWT workbench. The Sign tab lets you compose the header (alg, typ, kid) and the payload (any JSON), choose HS256/HS384/HS512, paste or auto-generate a secret, and produce a signed token using the browser Web Crypto API. Claim presets insert iat = now, exp = +1h/+24h/+7d, iss, aud, and a random jti with one tap. The Decode tab takes any token and shows the header, payload (with the standard claim names iss/sub/aud/exp/nbf/iat/jti annotated, and exp highlighted green/amber/red based on remaining lifetime), and the signature. The "Use in Sign" button takes a decoded token back into the Sign tab so you can tweak and re-sign it. Header editors warn on invalid JSON, secret box can be hidden or shown, and a random-secret button generates 32 bytes of hex. Everything runs in your browser — tokens and secrets never leave your device.
Details
- Category
- developer
- Version
- 1.0.0
- Size
- 18 KB
- Updated
- Jun 2026
Frequently Asked Questions
Does this verify JWT signatures?
The Decode tab shows the signature but does not verify it. Verification requires the right algorithm (HMAC for HS*, RSA/ECDSA for RS*/ES*) and the matching key. Use a server-side library like jsonwebtoken (Node), jose (Node/browser), or pyjwt (Python) for verification. The Sign tab uses Web Crypto HMAC and produces a signature that any standard verifier can check given the same secret and algorithm.
Why only HS256/HS384/HS512 and not RS256/ES256?
RS256 and ES256 use RSA and ECDSA asymmetric keys, which require importing a PEM private key. That works in browsers but the input UX is much messier (PEM parsing, key import via crypto.subtle.importKey with format=spki/pkcs8). HS256/384/512 cover the most common use case (shared-secret API tokens, internal service-to-service auth, local development) and stay truly offline. For RS/ES signing in the browser, use a tool dedicated to asymmetric keys.
What is the iat/exp preset?
iat (issued at) and exp (expiration) are standard JWT claims that store Unix seconds. The +1h/+24h/+7d buttons set exp to that many seconds in the future from now. The iat preset sets iat to the current Unix time. The jti preset generates 16 random hex characters for a unique token ID, useful for one-time tokens, password resets, or preventing replay attacks.
How does the random secret generator work?
It calls crypto.getRandomValues on a 32-byte Uint8Array (256 bits) and renders it as 64 hex characters. That meets the HS256 minimum key length (256 bits per RFC 7518 §3.2), the HS384 minimum (384 bits — short by 16 hex chars but still cryptographically strong), and the HS512 minimum (512 bits — also short). For HS384/HS512 you should use a 48-byte or 64-byte secret. Treat generated secrets like passwords — copy them into your secret manager and never commit them.
Is my secret sent anywhere?
No. Both signing and decoding are pure client-side JavaScript using the Web Crypto API. The secret, the header, the payload, and the resulting token all stay in your browser. There is no fetch, no XHR, no WebSocket, no CDN. You can use the tool to sign tokens for local development, test JWT-protected endpoints, or generate throwaway tokens without any data being transmitted.
