JWT generator
Build a token and sign it here. The signing happens in your browser, so the secret never leaves this device.
Used as UTF-8 text. For HS256 a secret shorter than 32 bytes is weak.
Signing runs entirely in this browser and nothing is sent anywhere. Even so, treat a production signing key as compromised once it has been pasted into any website, including this one. Use a test key here.
Questions people ask
Where does the signing happen?
In your browser, using the built-in Web Crypto API. No part of the token or the secret is sent to a server — this site has no server to send it to beyond the one that served the page.
Should I paste a real signing key in?
No. Even though nothing is uploaded, a key that has been pasted into a browser window can end up in clipboard history, a screenshot or a screen recording. Generate a test key for experimenting and keep production keys in your secret manager.
Why only HS256, HS384 and HS512?
These are the HMAC algorithms, which sign with a shared secret. RS256 and ES256 sign with a private key, which means handling key files, and pasting a private key into a web page is a habit worth not building. Decode and inspect any algorithm with the JWT decoder.