Free JWT Generator Online
Generate signed HS256 JWT tokens with custom payload and expiry. Runs entirely in your browser.
Key Features
Everything you need to create JWT tokens
Generates tokens signed with HMAC-SHA256. Compatible with all major JWT libraries and frameworks.
Add any claims to the JSON payload. Standard claims like sub, name and iat are pre-filled.
HMAC computation can run client-side in browser-side mode. Avoid entering sensitive keys unless local processing is clearly shown.
Key Takeaways
- This generator signs JWTs with HS256 (HMAC-SHA256) only, and the signing runs in your browser so your secret key stays on your device.
- You control the JSON payload claims while the tool fixes the header to HS256 and typ JWT, stamps iat if missing, and sets exp to the current time plus your chosen expiry (1 hour, 24 hours, 7 days, 30 days, or a custom value in seconds).
- Use a long, random secret of 32 characters or more, and verify the token with the identical secret and HS256 algorithm, since any mismatch or extra whitespace will fail signature verification.
- If you need asymmetric algorithms like RS256 or ES256, or production token issuance with key rotation, use a server-side JWT library instead, as this tool covers symmetric HS256 signing only.
How to Generate a Signed JWT
Enter Your Secret Key
Type the HMAC secret into the Secret Key field. This same string must be used by your application to verify the token, so keep it consistent. Longer, random secrets of 32 characters or more produce stronger signatures. The secret stays on your device because the signing runs in your browser.
Edit the Payload and Pick an Expiry
Adjust the JSON payload to hold your claims, such as sub, name, or any custom fields. The tool keeps your iat if present and otherwise stamps it automatically. Choose an expiry of 1 hour, 24 hours, 7 days, 30 days, or a custom value in seconds, which is added to the current time to set the exp claim.
Generate and Copy the Token
Click Generate JWT to build the three-part token. The header is fixed to HS256 and typ JWT, the payload is Base64URL encoded, and the signature is computed with HMAC-SHA256. Use the Copy button to grab the full token, then paste it into your client, API request, or a debugger to inspect it.
What Goes Into the Token
Every JWT this tool produces has three Base64URL segments joined by dots: a header, a payload, and a signature. The table below shows which parts are fixed and which you control.
| Element | Set By | Value or Behavior |
|---|---|---|
| Header alg | Fixed by tool | HS256 (HMAC with SHA-256) |
| Header typ | Fixed by tool | JWT |
| Payload claims | You | Any valid JSON, for example sub, name, roles |
| iat claim | Tool if missing | Current Unix time when you generate |
| exp claim | Tool | Current time plus your chosen expiry |
| Signature | Tool from your secret | HMAC-SHA256 over header.payload |
When This Generator Fits
Local Development
Spin up a valid HS256 token in seconds to test a protected endpoint without wiring up a full auth flow first. The signing happens on your device, so you can iterate quickly.
API Testing and Debugging
Craft a token with specific claims and expiry, then drop it into a request header to check how your service validates and decodes it. Useful for reproducing edge cases like an expired exp.
Learning JWT Structure
See exactly how the header, payload, and signature combine into a single string. Edit the payload and regenerate to watch how each change alters the encoded segments.
When to Use Something Else
If you need RS256, ES256, or other asymmetric algorithms, or production token issuance with key rotation, use a server-side JWT library. This tool covers HS256 symmetric signing only.
Common Problems and Fixes
Please enter a secret key
The Secret Key field is empty. A signature cannot be computed without it, so type any HMAC secret before generating. For meaningful security use a long, random value rather than a short word.
Invalid JSON payload
The payload box must contain valid JSON. Check for missing quotes around keys, trailing commas, or unescaped characters. The error message includes the parser detail so you can find the exact spot, then click Generate again.
Token fails signature verification
The verifier must use the identical secret and the HS256 algorithm. A mismatch in the secret, extra whitespace, or expecting RS256 will cause verification to fail. Confirm both sides share the same string.
Token reports as expired
The exp claim is set to the moment of generation plus your selected expiry. If a short window like 1 hour has passed, generate a fresh token or choose a longer expiry or a larger custom value in seconds.
About This Tool
This free JWT generator creates signed HS256 JSON Web Tokens directly in your browser. Enter a secret key, customize the JSON payload and select an expiry time to generate a valid JWT token you can use in your applications.
Frequently Asked Questions
Is this tool completely free?
Yes. The tool is 100% free to use with no registration, no subscription and no usage limits.
You can use it as many times as you need for personal or commercial projects without any cost.
We believe developer tools should be accessible to everyone without paywalls.
Is my secret key safe?
Yes. Browser-side workflows run locally in your browser using JavaScript. Your secret key stays on your device.
The HMAC-SHA256 computation runs entirely client-side using a pure JavaScript implementation.
You should still use unique secret keys for testing rather than your production secrets as a general security practice.
What algorithm does this tool use?
This tool uses the HS256 algorithm which is HMAC with SHA-256. This is the most widely supported JWT signing algorithm.
The generated tokens are fully standard and compatible with jwt.io, node-jsonwebtoken, python-jose, jjwt and other JWT libraries.
RS256 and other asymmetric algorithms are not supported as they require private keys unsuitable for browser tools.
Can I use these tokens in production?
Technically yes, the tokens are valid HS256 JWTs. However for production use we recommend generating tokens server-side using a trusted JWT library.
Always use strong, random secret keys of at least 32 characters and keep them confidential.
This tool is primarily intended for development, testing and debugging purposes.
Sources and References
Format and tool details on this page are based on the official specifications and documentation below.
- RFC 7519: JSON Web Token (JWT)- IETF
- Introduction to JSON Web Tokens- jwt.io
- RFC 8259: The JSON Data Interchange Format- IETF
- JSON- MDN Web Docs