JWT Generator
Create and sign a JWT with an HMAC secret — HS256, HS384 or HS512.
Signed entirely in your browser. Your secret is never sent anywhere.
- Produces a real, verifiable HMAC-signed token from a payload and secret, in any of the 3 standard HMAC-SHA strengths.
- Signed with Web Crypto in your browser — the secret is never transmitted.
- Faster than standing up an auth server for local testing.
Why this is private
- Signed entirely in your browser. Your secret is never sent anywhere.
- Open your browser's DevTools → Network tab while using this tool — you won't see a request carrying your input, because it never leaves your device.
- Nothing you enter is uploaded to a server or shared with us — the processing happens entirely on your device.
Overview
Builds and signs a JSON Web Token using HS256, HS384 or HS512 — useful for generating test tokens during development.
How to use it
- 1Choose an algorithm (HS256, HS384 or HS512).
- 2Enter a payload as JSON.
- 3Enter the HMAC secret your server will verify against.
- 4The signed token updates automatically.
Tips
- Only use this for test/development tokens with test secrets — never paste a real production signing secret into any web tool, including this one.
Frequently asked questions
What people use it for
Test an authenticated endpoint locallyMint a token with the claims your API expects and the dev signing secret.
Reproduce a permissions bugCraft a token with a specific `role` or `scope` claim to trigger the path.
Seed a token for an integration testGenerate a fixed token for a test that needs a valid JWT.
Test a server configured for a stronger HMAC variantSwitch to HS384 or HS512 if your server expects a stronger algorithm than the default HS256.
Learn how JWT signing worksChange the payload or secret and watch the signature segment change.
Related guides
- How to read JSON with a tree viewerA tree viewer turns a wall of brackets into a structure you can expand, search and copy paths from. Here's how to use one effectively.
- JSON parse errors explained: 'Unexpected token', 'Expected comma or brace', and the restWhat each common JSON error message actually means, the usual cause, and how to find the spot fast using line and column.
- How to format JSON (and actually understand the errors)JSON looks like a JavaScript object but follows stricter rules. Here's what those rules are and how to read the errors when they're broken.
Related tools
All developer toolsJWT DecoderDecode JWT headers and payloads, and verify HMAC signatures with a secret.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes, in hex or Base64, with a compare mode.JSON Viewer & FormatterView, format, validate, edit and beautify JSON with an interactive tree view, plus a shareable link.JSON ValidatorValidate JSON syntax and pinpoint errors instantly.
Ready to use JWT Generator?
JWT Generator