JWT Generator
Create signed JSON Web Tokens with HS256/384/512, RS, PS, ES or EdDSA. Edit the payload, set exp and iat, generate keys or secrets – all in your browser.
Use at least as many random bytes as the hash size (32 bytes for HS256). Short passwords can be brute-forced offline.
What is JWT Generator?
The JWT generator signs any JSON payload into a compact JSON Web Token. It supports HMAC (HS256/384/512), RSA (RS256/384/512), RSA-PSS (PS256/384/512), ECDSA (ES256/384/512) and EdDSA (Ed25519), can add iat and exp claims with one click, and can generate a random secret or a key pair whose public key you can use for verification.
How to use JWT Generator
- Choose the algorithm.
- Edit the payload JSON; use the buttons to set iat to now or exp to one hour or one day ahead.
- Enter a secret (HS*) or a PKCS#8 PEM / JWK private key – or press Generate random secret / Generate key pair.
- Optionally set a key ID (kid), then press Sign token and copy the token (and the public key for asymmetric algorithms).
Example
HS256, payload {"sub":"1"}, secret your-256-bit-secret eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIn0.rTCH8cLoGxAm_xw68z-zXVKi9ie6xJn9tnVWjd_9ftE
When to use JWT Generator
Use it to create test tokens for API development, reproduce bugs or learn how JWT signing works. For production, issue tokens from your auth server so keys stay in a secret store; never paste production private keys into a website.
How JWT Generator works
Signing uses the jose library on top of the browser's Web Crypto API. The header is {"alg": …, "typ": "JWT"} plus an optional kid; header and payload are serialized as JSON, Base64URL-encoded and signed. HMAC secrets are used as UTF-8 bytes, or decoded from Base64/Base64URL when that box is ticked. Generated HMAC secrets are 32/48/64 random bytes matching the hash size; key pairs are created with Web Crypto and exported as PKCS#8 and SPKI PEM.
Common Use Cases
- Create an expired token to test your API's 401 handling.
- Generate an RS256 key pair and token to test a JWKS-based validator.
- Sign a token with custom claims for local development.
- Demonstrate the difference between HS256 and ES256 signatures.
Security Note
Use throw-away keys for testing. A short or guessable HMAC secret can be brute-forced offline from any token signed with it.
FAQs
Which algorithm should I use?
HS256 when the same service issues and verifies tokens and can keep a shared secret. RS256, ES256 or EdDSA when other parties must verify tokens with a public key.
Why is my RSA key rejected?
Keys starting with BEGIN RSA PRIVATE KEY are PKCS#1. Convert them with openssl pkcs8 -topk8 -nocrypt -in key.pem to PKCS#8 (BEGIN PRIVATE KEY).
Are generated keys stored?
No. They exist only in the page until you leave it.