JWT Generator & Signer
Create and sign JSON Web Tokens with HS256, HS384, or HS512 using the Web Crypto API. Set expiry, add custom claims, and copy the signed JWT instantly.
HS256 vs HS384 vs HS512
All three are HMAC-based algorithms. HS256 is the most widely supported and sufficient for most applications. HS384 / HS512 produce larger signatures — useful when you need additional collision resistance or are matching a specific compliance requirement. For asymmetric signing (RS256, ES256), you need a key pair — use your backend, not this browser tool. Never use this tool in production with real secrets — it's for development, testing, and learning only.
{"alg":"HS256","typ":"JWT"} — specifies the signing algorithm — Base64url encoded
Claims JSON (sub, iat, exp, custom fields) — Base64url encoded
Base64url(header) + '.' + Base64url(payload) — the exact bytes that are signed
HMAC-SHA256(signing_input, secret) — keyed hash proves the token was issued by a party holding the secret
header.payload.Base64url(signature) — compact, URL-safe, self-contained token
Spec: RFC 7519 (JWT), RFC 7515 (JWS), RFC 2104 (HMAC)