JWT generator — sign a token with HMAC
Enter a payload and a secret and get a signed JWT (HS256, HS384 or HS512). It signs entirely in your browser using Web Crypto (0 uploads, works offline), so your secret never leaves your device.
How to use it
- Enter the JSON payload and your secret.
- Choose the HMAC algorithm.
- Copy or Download the signed token.
FAQ
How do I generate a signed JWT for free?
Enter a JSON payload and a secret, pick HS256, HS384 or HS512, and this page signs the token with HMAC using your browser's Web Crypto — on your device with no upload.
Is my secret sent anywhere?
No. Signing happens entirely in your browser and neither the secret nor the token is transmitted or stored, which you can verify by turning off your Wi-Fi. A signing secret must never be shared, so keeping it on-device is essential.
Which algorithms are supported?
The symmetric HMAC algorithms HS256, HS384 and HS512. These use one shared secret to both sign and verify, so keep that secret server-side in production.
Can I decode the token afterwards?
Yes — paste it into the JWT decoder to see the header and payload, or the JWT security linter to review it for risks.
Limits
Signs with symmetric HMAC algorithms; asymmetric signing (RS/ES) with a private key is not offered here.
Related
The JWT decoder reads a token; the JWT security linter reviews it.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.