BYTETOOLS

JWT Generator

Generate and sign a JWT with HS256 using the Web Crypto API. Edit the header and payload JSON, add a secret, and get a signed token. Free and 100% private.

The token is signed locally with the Web Crypto API — your secret and payload never leave your browser. HS256 is symmetric, so anyone with the secret can forge tokens; keep it private.

What is the JWT Generator?

The ByteTools JWT Generator builds and signs a JSON Web Token using the HS256 (HMAC-SHA256) algorithm.

  • Signs tokens with HS256 (HMAC-SHA256)
  • Editable header and payload JSON with validation
  • Real signatures via the Web Crypto API
  • Correct base64url encoding of every segment
  • One-click copy of the finished token
  • 100% client-side — secret and claims never leave your browser

How to use the JWT Generator

  1. 1

    Edit the header JSON (the default is HS256/JWT).

  2. 2

    Edit the payload JSON with your claims, such as sub, name and exp.

  3. 3

    Enter the secret to sign the token with.

  4. 4

    Click Generate JWT to produce the signed token.

  5. 5

    Copy the token for use in your app or API request.

About the JWT Generator

The ByteTools JWT Generator builds and signs a JSON Web Token using the HS256 (HMAC-SHA256) algorithm. Edit the header and payload as JSON, supply your signing secret, and the tool produces a complete, signed token you can copy straight into a request or test.

Signing is done with the browser's built-in Web Crypto API, computing a real HMAC-SHA256 signature over the base64url-encoded header and payload. The header and payload JSON are validated before signing, so mistakes are caught with a clear message rather than producing a broken token.

Your secret, header and payload never leave your browser — all cryptography happens locally. It pairs naturally with a JWT decoder for round-trip testing, and is ideal for creating test tokens during development without a backend.

Frequently asked questions

What is a JWT?

A JSON Web Token is a compact, signed token with three base64url-encoded parts — header, payload and signature — joined by dots. It carries claims (data) that a server can verify with a shared secret or key, commonly used for authentication.

How does HS256 signing work?

HS256 computes an HMAC using SHA-256 over the header and payload, keyed by your secret. Anyone holding the same secret can recompute the signature to verify the token has not been tampered with. This tool performs that HMAC with the Web Crypto API.

Is it safe to sign a JWT in the browser?

Yes, for generating test tokens the signing runs locally and your secret never leaves the page. In production, however, HS256 secrets should live only on your server, since anyone who has the secret can mint valid tokens.

What should I put in the payload?

The payload holds claims such as sub (subject), iat (issued at), exp (expiry) and any custom data your app needs. Keep it small, avoid secrets, and remember the payload is only encoded, not encrypted, so anyone can read it.

Can I verify or decode the token afterwards?

Yes. Paste the generated token into a JWT decoder to inspect its header and payload, and use the same secret to confirm the signature is valid. This makes round-trip testing during development quick and easy.

Does my secret get uploaded?

No. The header, payload and secret are all processed in your browser using the Web Crypto API, so none of them are transmitted to any server.

Guides for JWT Generator

Related tools