Free · Private · Client-side
JWT Token Generator
Encode a JSON Web Token from an editable header and payload, or paste one to inspect and verify it. HS256, HS384, HS512, and RS256 run in your browser. For development and testing — the secret and private key stay on this device.
Generated values never leave this device.Local development tool
Signing and verification happen in this browser with the Web Crypto API. Nothing is uploaded. Do not paste a production private key, and do not put secrets in the payload — a JWT is signed, not encrypted. Need only the HMAC key? Use the JWT secret generator.
Encode
The alg field is set from this control when the token is signed. ES256 is not signed here.
Used as UTF-8 text, matching jwt.sign(payload, secret) when the secret is a string. A value from the JWT secret generator can be pasted as-is.
Signed token
Header and payload are parsed and re-serialized without extra whitespace before signing.
Decode and verify
Paste a token to read the header and payload. Add the HMAC secret or the RS256 public key above to check the signature.
Frequently asked questions
What does this JWT token generator sign?
It signs the compact JSON of the header and payload you edit. HS256, HS384, and HS512 use the HMAC secret as UTF-8 text, the same default as jsonwebtoken when the secret is a string. RS256 signs with a PKCS#8 RSA private key generated in the browser or one you paste. The alg field in the signed token is taken from the algorithm control.
Can I verify an existing token?
Yes. Paste a token to inspect the header and payload without a key. Add the HMAC secret, or the RS256 public key (a PUBLIC KEY PEM), to check the signature. The none algorithm is rejected. ES256 and other algorithms are shown but not verified.
Do secrets leave the browser?
No. Signing, key generation, decoding, and verification use the Web Crypto API on this page. The HMAC secret and RSA private key are not uploaded. This is a development and testing tool: do not paste a production private key into a machine you do not trust.
Why is ES256 missing?
HS256 and RS256 cover the two algorithms most local tests need, and both run entirely in Web Crypto. ES256 (ECDSA P-256) is not signed or verified on this page. Generate an HMAC secret on the JWT secret generator if you only need key material for your own library.