Free JWT Generator (HS256)
Build a signed HS256 JSON Web Token for testing · edit the payload, set a secret, and copy the token. Everything runs locally via Web Crypto.
Frequently asked
Is it safe to paste a real secret here?
The signing runs entirely in your browser · nothing is transmitted. Still, treat any secret that has touched a third-party page as compromised in principle: for production keys, rotate rather than reuse.
What claims should a JWT include?
At minimum: exp (expiry · keep it short, minutes not months), iat (issued at), and sub (the subject). Add iss and aud so tokens can't be replayed across services. Never put passwords or PII in claims · JWTs are readable by anyone who holds them.
Related tools
- HMAC Generator · Compute an HMAC signature from a message and secret key · SHA-256/384/512, hex or Base64 output, all in your browser via Web Crypto.
- PKCE Generator · Generate a spec-compliant PKCE pair · a random code_verifier and its SHA-256 code_challenge · for testing OAuth 2.0 authorization-code flows.
- Basic Auth Generator · Turn a username and password into a ready Authorization: Basic header · encoded locally, never transmitted.