How to Generate a Signed JWT
Enter Your Secret Key
Type the HMAC secret into the Secret Key field. This same string must be used by your application to verify the token, so keep it consistent. Longer, random secrets of 32 characters or more produce stronger signatures. The secret stays on your device because the signing runs in your browser.
Edit the Payload and Pick an Expiry
Adjust the JSON payload to hold your claims, such as sub, name, or any custom fields. The tool keeps your iat if present and otherwise stamps it automatically. Choose an expiry of 1 hour, 24 hours, 7 days, 30 days, or a custom value in seconds, which is added to the current time to set the exp claim.
Generate and Copy the Token
Click Generate JWT to build the three-part token. The header is fixed to HS256 and typ JWT, the payload is Base64URL encoded, and the signature is computed with HMAC-SHA256. Use the Copy button to grab the full token, then paste it into your client, API request, or a debugger to inspect it.
What Goes Into the Token
Every JWT this tool produces has three Base64URL segments joined by dots: a header, a payload, and a signature. The table below shows which parts are fixed and which you control.
| Element | Set By | Value or Behavior |
|---|---|---|
| Header alg | Fixed by tool | HS256 (HMAC with SHA-256) |
| Header typ | Fixed by tool | JWT |
| Payload claims | You | Any valid JSON, for example sub, name, roles |
| iat claim | Tool if missing | Current Unix time when you generate |
| exp claim | Tool | Current time plus your chosen expiry |
| Signature | Tool from your secret | HMAC-SHA256 over header.payload |
When This Generator Fits
Local Development
Spin up a valid HS256 token in seconds to test a protected endpoint without wiring up a full auth flow first. The signing happens on your device, so you can iterate quickly.
API Testing and Debugging
Craft a token with specific claims and expiry, then drop it into a request header to check how your service validates and decodes it. Useful for reproducing edge cases like an expired exp.
Learning JWT Structure
See exactly how the header, payload, and signature combine into a single string. Edit the payload and regenerate to watch how each change alters the encoded segments.
When to Use Something Else
If you need RS256, ES256, or other asymmetric algorithms, or production token issuance with key rotation, use a server-side JWT library. This tool covers HS256 symmetric signing only.
Common Problems and Fixes
Please enter a secret key
The Secret Key field is empty. A signature cannot be computed without it, so type any HMAC secret before generating. For meaningful security use a long, random value rather than a short word.
Invalid JSON payload
The payload box must contain valid JSON. Check for missing quotes around keys, trailing commas, or unescaped characters. The error message includes the parser detail so you can find the exact spot, then click Generate again.
Token fails signature verification
The verifier must use the identical secret and the HS256 algorithm. A mismatch in the secret, extra whitespace, or expecting RS256 will cause verification to fail. Confirm both sides share the same string.
Token reports as expired
The exp claim is set to the moment of generation plus your selected expiry. If a short window like 1 hour has passed, generate a fresh token or choose a longer expiry or a larger custom value in seconds.