100% Local — never leaves your browser

JWT Generator

Build and sign a JWT from a custom header, payload, and secret, entirely in your browser.

Ad slot

How to use this tool

This tool constructs a JWT (JSON Web Token) from a header and payload you provide, then signs it with HS256 using the secret you enter — the same construction used by the JWT Decoder to inspect tokens. It's meant for testing: generating a token to paste into an API client, trying out how a backend handles a particular set of claims, or understanding exactly how a JWT is built from its three parts.

Edit the Header and Payload JSON, enter a Secret, and click Generate JWT. The header's alg is always forced to match the algorithm you selected, since the token would otherwise misrepresent how it was actually signed. Click Copy to copy the result.

For testing and development only: everything runs locally in your browser and nothing is transmitted anywhere — but this tool still isn't the right place to generate or paste real production secrets. Use throwaway test secrets here.

FAQ

Is this JWT generator free to use?

Yes, this tool is completely free to use with no limits on how often you can use it.

Does my secret or payload get uploaded anywhere?

No. The token is signed directly in your browser using the Web Crypto API. Your secret, header, and payload are never sent anywhere — including to this site's own servers, which don't exist for this tool.

Is it safe to use this for a real, production secret?

Treat this as a testing and development tool only, not a place to generate or handle production credentials. Even though signing happens locally, this page still runs in a general-purpose browser tab rather than a hardened secrets-management environment — pasting a real production signing secret into any web page is a habit worth avoiding. Use throwaway or test-only secrets here.

Which algorithms are supported?

Only HS256 (HMAC-SHA256) for now — a symmetric algorithm where the same secret both signs and verifies the token. Asymmetric algorithms like RS256, which sign with a private key and verify with a separate public key, aren't supported yet.

Related Tools

JWT Decoder

Decode a JWT's header, payload, and expiry status instantly.

Regex Tester

Test regular expressions with live-highlighted matches and groups.

JSON to Python Converter

Generate Python dataclasses from a JSON sample, with types inferred automatically.

Cron Expression Parser

Explain a cron expression in plain English and see its next 5 run times.