Why only HS256, and not RS256?

HS256 uses one shared secret, which is a self-contained calculation. RS256 signs with an RSA private key, which needs key parsing and big-integer arithmetic — a large amount of code to ship to a browser for a tool most people use to test a header. HS256 covers the common testing case.

Can I put sensitive data in a JWT?

No. A JWT is signed, not encrypted — the payload is base64, not ciphertext, and anyone holding the token can read every claim in it by pasting it into a decoder. The signature proves the claims haven't been altered; it does nothing to hide them. Put an ID in the token and keep the sensitive data on your server.

How long should my signing secret be?

At least 32 bytes for HS256. Anything shorter can be brute-forced offline from a single captured token — an attacker guesses secrets until one reproduces the signature, with no need to talk to your server at all. This tool warns you when the secret you've entered is under that.

JWT Generator

Build a signed JSON Web Token for testing an API or reproducing a bug. Set the standard claims — subject, issuer, audience, expiry — add whatever custom claims your service reads, and get back a token signed with HMAC-SHA256. The signing runs in this page using a hand-written HMAC implementation checked against the RFC 4231 test vectors, so your secret is never transmitted anywhere.

Signing secret

Never leaves this page — the signing happens in your browser. Even so, don't paste a production secret into any website.

Subject (sub)

Issuer (iss)

Audience (aud)

Expires in (minutes)

0 leaves the exp claim out entirely, which means the token never expires.

Issued at

A Unix timestamp in seconds. Leave at 0 to use the current time.

Extra claims (JSON)

Result

Enter a signing secret to produce a token.

Nothing is uploaded — this tool runs inside your browser, so your files never leave your device.

Help us improve

Why use this tool

HS256 signing, done in your browser — the secret is never uploaded
Standard sub, iss, aud, iat and exp claims, plus any custom JSON you add
Warns you when the signing secret is too short to be safe
Set iat explicitly to reproduce the exact same token twice

How it works

1Enter the signing secret your service uses to verify tokens.
2Fill in the claims you need, and any extra ones as JSON.
3Copy the token and paste it into your Authorization header.

JWT Generator — frequently asked questions

The signing genuinely happens in your browser — there is no request, and you can prove it by disconnecting from the internet and watching the tool keep working. Even so, the honest advice is not to paste a production secret into any website, this one included. Use a throwaway secret for testing, and generate real tokens on your own server.

More developer tools

Text → Base64 Base64 → Text URL Encoder URL Decoder JSON Formatter JSON Minifier

Looking for something else? Browse all developer tools

Explore the other tools

Same deal everywhere on the site — free, no sign-up, and no watermark on anything you download.

QR Code Tools Barcode Tools PDF Tools Image Tools SEO Tools Text Tools Calculators Unit Converters Color Tools File Tools Business Tools AI Tools Utilities

Or see every tool on one page.