JWT Generator

How it works

This JWT generator builds a token from the two JSON documents you provide. The header and payload are each serialized, UTF-8 encoded, and base64url-encoded, then joined with a dot. For the HMAC algorithms, your secret is imported as a key with the Web Crypto API (crypto.subtle.importKey and sign) and used to compute an HMAC over header.payload with SHA-256, SHA-384, or SHA-512. The resulting signature is base64url-encoded and appended as the third segment.

Everything runs locally in your browser. Your payload and your signing secret are never sent to any server, logged, or stored. No signup, no tracking. Works on any modern browser, on both mobile and desktop.

Frequently asked questions

Is my signing secret ever uploaded?

No. The secret stays in your browser and is used only by the local Web Crypto API to compute the signature. It is never transmitted, saved, or included in the token output. Once you close the tab it is gone.

What does the "none" algorithm produce?

It produces an unsigned token with an empty third segment (header.payload.) and sets alg to none in the header. Most servers reject "none" tokens for security reasons, so use it only for testing or when a system explicitly expects unsigned tokens.

How long should my HMAC secret be?

For HS256 the secret should be at least 256 bits (32 bytes) of entropy, and correspondingly longer for HS384 and HS512. Short or dictionary-based secrets can be brute forced offline once someone has the token. This tool accepts any text but does not pad or weaken it.

Can I generate RS256 or ES256 tokens?

Not here. This tool covers the HMAC family (HS256, HS384, HS512) plus unsigned tokens. RSA and ECDSA signing require a private key and a different key format, which is outside this tool's scope.

More tools from Clean.tools

• JWT Decoder Decode and inspect the tokens you build
• Base64 Encoder Encode and decode Base64 text and images
• Hash Generator Compute SHA-1, SHA-256, and SHA-512 hashes

View all tools