Why only HS256/384/512 and not RS256 or ES256?

HS* algorithms sign with a single shared secret, which is what this tool's secret-key field is for. RS*/ES* need a private key and are typically generated server-side with proper key management, not typed into a browser field — for those, use a backend library or your identity provider's tooling.

Is my secret sent anywhere?

No. Signing happens locally with the browser's built-in Web Crypto API (crypto.subtle.importKey / sign) — the secret and the token never leave your machine.

Do I need to include exp or iat myself?

Yes — this tool signs exactly the payload JSON you provide, it doesn't add or manage claims for you. Add exp, iat, iss, or any other claims you need directly in the payload editor, as Unix timestamps where required.

Can I decode a token I already have instead?

This tool builds and signs new tokens. If you need to inspect or verify an existing JWT, use the JWT Decoder tool instead — it decodes the header/payload and can verify the signature against a key you provide.

Why does the header always show the algorithm I picked?

The signed alg claim always has to match the algorithm actually used to compute the signature, so this tool overwrites whatever alg value you typed in the header editor with the one you selected above it before signing.

JWT GENERATOR

Build a header and payload, sign it with an HS256/384/512 secret, and get a working JWT — signed right in your browser.

Algorithm

Header

Payload

Secret (HMAC key)

Signed token

—

How to generate a JWT

1
Pick an algorithm: HS256, HS384, or HS512.
2
Edit the header and payload JSON — the alg field in the header is kept in sync automatically.
3
Type the HMAC secret key that should sign the token.
4
Copy the signed token from the box at the bottom.

Questions

Why only HS256/384/512 and not RS256 or ES256?: HS* algorithms sign with a single shared secret, which is what this tool's secret-key field is for. RS*/ES* need a private key and are typically generated server-side with proper key management, not typed into a browser field — for those, use a backend library or your identity provider's tooling.
Is my secret sent anywhere?: No. Signing happens locally with the browser's built-in Web Crypto API (crypto.subtle.importKey / sign) — the secret and the token never leave your machine.
Do I need to include exp or iat myself?: Yes — this tool signs exactly the payload JSON you provide, it doesn't add or manage claims for you. Add exp, iat, iss, or any other claims you need directly in the payload editor, as Unix timestamps where required.
Can I decode a token I already have instead?: This tool builds and signs new tokens. If you need to inspect or verify an existing JWT, use the JWT Decoder tool instead — it decodes the header/payload and can verify the signature against a key you provide.
Why does the header always show the algorithm I picked?: The signed alg claim always has to match the algorithm actually used to compute the signature, so this tool overwrites whatever alg value you typed in the header editor with the one you selected above it before signing.