How to Generate and Sign a JWT Online with HS256

July 6, 2026

To generate a signed JWT online, open ByteTools JWT Generator, edit the header and payload JSON, enter a signing secret, and click Generate JWT — the tool produces a complete HS256-signed token you can copy straight into a request. Signing uses the browser's Web Crypto API to compute a real HMAC-SHA256 signature, so the token is genuinely valid, not a mock.

Here is the full walkthrough, plus what each of the three token segments contains and why doing it in the browser is safe for test tokens.

Step-by-step: building your token

Edit the header JSON. The default is {"alg":"HS256","typ":"JWT"}, which is correct for HMAC signing — you rarely need to change it.
Edit the payload JSON with your claims, such as {"sub":"123","name":"Ada","exp":1735689600}.
Enter your signing secret — the shared key the server will use to verify the token.
Click Generate JWT. The header and payload are validated, then signed.
Copy the token and drop it into an Authorization header, a test request or your app.

What the three segments are

Segment	Contents	Encoding
Header	Algorithm and token type (HS256/JWT)	base64url
Payload	Your claims — sub, name, iat, exp, custom data	base64url
Signature	HMAC-SHA256 over header.payload, keyed by your secret	base64url

The three parts are joined by dots into the familiar xxxxx.yyyyy.zzzzz shape. Anyone with the same secret can recompute the signature to confirm the token was not tampered with.

How the signing works

The tool base64url-encodes the header and payload, joins them with a dot, and computes an HMAC-SHA256 of that string using your secret as the key — all through the standard Web Crypto API. The resulting digest is base64url-encoded as the third segment. Because it validates the header and payload JSON first, a typo produces a clear error instead of a broken token.

Why generate JWTs in the browser

Your secret, header and payload never leave the page — all cryptography runs locally. That makes it ideal for spinning up test tokens during development without standing up a backend. It pairs naturally with a JWT decoder: generate a token here, decode it there, and confirm the round trip.

Try the JWT Generator — free and 100% in your browser.

FAQ

What is the minimum I need to generate a token?

A valid payload and a secret. The default header already specifies HS256, so you can leave it as-is, add a claim or two to the payload, type any secret, and generate.

How do I set an expiry on the token?

Add an exp claim to the payload as a Unix timestamp in seconds. Servers that check expiry will reject the token after that moment; without exp, the token does not expire on its own.

Can I verify the token I just generated?

Yes. Paste it into a JWT decoder to read the header and payload, and use the same secret to confirm the signature validates — a quick round-trip check during development.

Does the payload keep my data secret?

No. The payload is only base64url-encoded, not encrypted, so anyone can read it. Never put passwords or secrets in the payload; it is for claims a server will verify, not for confidential data.

Related free tools

JWT Decoder — inspect a token's header and payload.
Base64 Encoder — encode and decode base64 strings.
SHA-256 Hash Generator — compute SHA-256 digests.
Basic Auth Header Generator — build Authorization headers.

Built by ByteVancer

ByteTools is a free product of ByteVancer, a software and web development studio building web apps, SaaS and custom software. If you need help building secure, well-architected products, explore what ByteVancer can do.

Guide