Generate a signed JWT (HS256) from a JSON payload and a secret key, computed entirely in your browser with our own SHA-256/HMAC implementation.
Google AdSense Banner
This area will contain advertisements after approval.
Google AdSense Banner
This area will contain advertisements after approval.
This tool builds a standard HS256 JWT: the header ({"alg":"HS256","typ":"JWT"}) and your payload are base64url-encoded and joined with a period, then signed with HMAC-SHA256 using your secret key. The signature is appended as a third base64url segment, producing a complete, verifiable token. Both the SHA-256 and HMAC logic are implemented directly in this tool, no crypto library involved, and verified to produce byte-identical output to standard implementations.
Anyone with your secret key can generate valid tokens that your server will accept, or verify tokens they intercept, so treat it like a password. This tool runs entirely in your browser and never transmits your secret anywhere, but you should still avoid using a real production secret in any external tool, use this for testing, prototyping, or generating tokens with throwaway secrets.
HS256 (HMAC with SHA-256) is symmetric, signing and verifying both use the same secret key, which is why it can be implemented and computed entirely client-side. Asymmetric algorithms like RS256 require a private/public key pair and are a separate, more involved implementation.
No, the entire signing process runs in your browser using JavaScript. Your secret and payload are never transmitted to or stored on our servers.
Yes, paste the generated token into our JWT Decoder to see its decoded header and payload. Full signature verification would require re-computing the HMAC with the same secret, which this decoder intentionally doesn't do since it never asks for a secret.
Google AdSense Banner
This area will contain advertisements after approval.