DevConvertor
Security & Cryptography Tools

JWT Generator

Build a JWT payload, choose an HMAC algorithm (HS256/384/512), and sign it with a secret you provide. For learning and local testing — not a substitute for a real authentication system, and your secret is never sent anywhere or stored.

This tool encodes and signs a token — it does not verify one, and it is not a substitute for a real authentication system. Everything runs in your browser and your secret is never sent anywhere or saved to storage, but a secret typed into any public web page should never be treated as appropriate for production secret management. Use this for learning and local testing only.

Related tools

JWT Decoder

Decode a JWT's header and payload — without verifying its signature.

JWT Inspector

A deeper look at a JWT's structure, sizes, and expiration status.

Features

  • HS256, HS384, or HS512 HMAC signing via the Web Crypto API
  • Edit the payload as JSON before signing
  • Secret is never sent to a server or written to storage
  • Clear wipes the secret along with the rest of the form

How to use

  1. Edit the payload JSON (claims like sub, name, iat).
  2. Choose an HMAC algorithm and enter a secret.
  3. Click Generate to get a signed token.

FAQ

Is this safe to use with a real production secret?
No. Nothing here is uploaded — signing happens locally with the Web Crypto API and the secret is never stored — but typing a production secret into any web page, this one included, isn't good secret hygiene. Use a throwaway value for testing.
Why only HS256/384/512?
Those are symmetric HMAC algorithms that can be implemented safely with a plain secret string. Asymmetric algorithms like RS256 need real private-key management, which isn't something a browser tool can responsibly provide.
What's the difference between encoding and signing?
Encoding turns your header and payload into Base64URL text — reversible by anyone. Signing adds a cryptographic signature over that text using your secret, so a verifier holding the same secret can confirm it wasn't altered.