Use a browser-based JWT generator to build a JSON Web Token from your header and payload and sign it with HS256 using a secret you provide. Everything, including the secret, stays on your device, so you can create test tokens without handing your signing key to a website.
Free JWT generator. Build and sign a JSON Web Token from your payload and a secret using HS256 via the Web Crypto API. Pairs with the JWT decoder. Runs privately.
Open JWT Generator (HS256) → Free toolFree JWT decoder. Decode a JSON Web Token to inspect its header and payload claims instantly in your browser. Shows expiry in human-readable time.
Open JWT Decoder →A JWT has three parts: a header naming the algorithm, a payload of claims, and a signature. With HS256 the signature is an HMAC of the header and payload computed with a shared secret, which is what lets a server later verify the token was not tampered with. A generator lets you set the claims, supply the secret, and produce a correctly signed token for testing an API or an auth flow.
The signing secret is the key to forging valid tokens, so pasting it into a website that signs the token server-side hands over the ability to mint tokens for your system. A client-side generator computes the HMAC in your browser with the Web Crypto API, so the secret never leaves your machine. Pair it with a decoder to inspect any token's header and payload while debugging.
HS256, which signs the token with an HMAC using a shared secret you supply.
No. The token is signed in your browser with the Web Crypto API, so the secret never leaves your device.
No. This is for testing and learning. Production tokens should be issued by your real auth service.