What is JWT Generator?
The JWT Generator builds and signs a JSON Web Token using the HS256 algorithm from a payload and a secret you provide. JWTs are defined in RFC 7519, their signing structure in JWS (RFC 7515), and the algorithms in JWA (RFC 7518). HS256 is HMAC with SHA-256 — a symmetric MAC keyed by a shared secret.
You edit the payload JSON (and optional header fields), enter a signing secret, and the tool produces a compact token of three Base64URL segments. Signing uses the Web Cryptography API's HMAC implementation, entirely in your browser.
The generated token is intended for local testing. Your secret never leaves your device.
Why Use This Tool?
During development you often need a valid signed token to exercise an API or middleware. Generating one locally with your own secret lets you craft specific claims and expiries without deploying an auth server or exposing real secrets online.
- Create test tokens with custom claims.
- Exercise HS256-protected endpoints locally.
- Control expiry and header fields precisely.
- Keep your signing secret on your device.
How Does This Tool Work?
The tool assembles a header ({"alg":"HS256","typ":"JWT"} plus any extras), Base64URL-encodes the header and payload, and joins them with a dot. It imports your secret as an HMAC key with SHA-256 via crypto.subtle.importKey, signs the header.payload string, and appends the Base64URL-encoded signature.
The result is a standard compact JWS: header.payload.signature. Anyone with the same secret can verify it; anyone at all can decode the header and payload, because those segments are only encoded.
Understanding Your Results
The output is a three-segment token. The signature binds the header and payload to your secret, so a verifier holding that secret can confirm the token was not altered. Change the secret and the signature changes completely.
This is HS256 (symmetric) only — it does not produce RS256/ES256 tokens signed with a private key. A generated token is exactly as trustworthy as the secret used to sign it, and it proves nothing to a party that does not share that secret.
Why Tracking This Matters
Understanding that HS256 relies on a shared secret is essential: the same key both signs and verifies, so leaking it lets anyone forge tokens. For production, secrets must be strong and kept server-side, and many systems prefer asymmetric algorithms so verifiers never hold signing keys.
Benefits of Using JWT Generator
- HS256 signing via Web Crypto HMAC
- Editable payload and header
- Standard compact JWS output
- Precise control over claims and expiry
- Secret stays in your browser
- No auth server required for testing
How Is the Result Calculated?
The signature is HMAC-SHA256(secret, base64url(header) + "." + base64url(payload)), then Base64URL-encoded. HMAC (RFC 2104) combines the secret and message through the SHA-256 hash to produce a keyed authentication tag that only a holder of the secret can reproduce.
token = base64url(header).base64url(payload).base64url(HMAC-SHA256(secret, data))
Tips for Better Results
- Use only test secrets here — never paste production signing keys.
- Set exp (seconds since epoch) to control token lifetime.
- Keep HS256 secrets long and random; short secrets are easy to brute-force.
- Remember the payload is readable — never put secrets in claims.
- Use the JWT Decoder to inspect the token you generated.
Standards and References
Conclusion
The JWT Generator signs HS256 tokens locally with your secret, giving you precise control over claims for development and testing.
Treat generated tokens as test artifacts: keep secrets strong and offline, never put confidential data in the payload, and verify signatures server-side.