مولّد JWT

A JWT generator that builds and signs JSON Web Tokens from your payload and secret, entirely in your browser using the Web Crypto API. It pairs with the JWT decoder, which inspects an existing token.

A JWT has three parts separated by dots: a header, a payload of claims, and a signature, each Base64url encoded. The signature is what makes the token trustworthy: it proves the payload has not been altered and was issued by someone who holds the secret.

This tool signs with HS256, that is HMAC using SHA-256, the most common symmetric JWT algorithm. The same secret both signs and verifies the token, so it must be kept private on the server.

For HS256, use a long, random secret. A short or guessable secret undermines the whole token, since anyone who guesses it can mint valid tokens of their own.

An important point about JWTs: the payload is only encoded, not encrypted. Anyone with the token can read its claims by Base64-decoding them, so never put passwords or sensitive data in a JWT. The signature stops tampering, it does not provide secrecy.

Because signing happens locally, your secret and payload never leave your device. Even so, avoid pasting real production secrets on a shared or public computer.