JWT Generator: Create Signed JSON Web Tokens (HS256)
Generate signed JSON Web Tokens with a custom header, payload, and HS256 secret for testing auth flows. Signing happens locally. Your secret is never sent.
Runs in your browser. Nothing is uploaded.
How it works
- Step 1: Paste your inputPaste directly into the editor, drop a file onto it, or use "Open file" to pick one from your device. Nothing is sent anywhere when you do.
- Step 2: Run the toolAdjust the options if you need to, then run it. Results appear beside your input so you can compare the two.
- Step 3: Copy or download the resultCopy the result to your clipboard in one click, or save it as a file. You can also keep editing and re-run as many times as you like.
About this tool
- Runs in your browser. All processing happens locally in this tab using JavaScript.
- No uploads. Your data is never sent to a server. There is no server to send it to.
- Works offline. Once the page has loaded you can disconnect and keep working.
- Unlimited & free. No usage caps, no paywall, no file size tiers.
Start with your own data. Open a file
What happens to your data
The same questions a security review would ask, answered plainly.
- Read via
- Typed or pasted into the page
- Held in
- Your browser tab's memory for as long as it is open
- Stored
- Nothing. No cookies, no database, no server-side copy
- Transmitted
- Nothing leaves your device
- Retained after you close the tab
- Nothing
- Works offline
- Yes, once the page has loaded
Why use this tool
What you get here that a server-side alternative cannot offer.
Your data never leaves the tab
There is no upload step and no server to receive one. The page loads once, then all work on your input happens in local JavaScript.
No caps or paywalls
No daily limits, no per-file ceilings imposed by a server tier, no watermarks, and no account. The practical limit is your own device's memory.
Frequently asked questions
Is my signing secret transmitted?
No. The token is signed in your browser using the Web Crypto API, so the secret never leaves your device.
Which claims should I include?
At minimum an expiry (exp) and issued-at (iat). Add sub for the subject, iss for the issuer, and aud for the intended audience so your verifier can reject misdirected tokens.
Are these tokens safe for production?
Use them for local testing only. Production tokens should be issued by your auth server with a strong secret or an asymmetric key that is rotated and never pasted into a browser.
Is my text uploaded to a server?
No. JWT Generator is a static page with no backend. Your text is read and processed by JavaScript running in this tab, and it is never transmitted. You can confirm this by opening your browser's network panel while you use the tool. There are no outbound requests.
How much data can I paste in?
There is no server-side cap. Very large inputs are limited only by your device's memory and will make the page feel slower, since the work happens on the main thread. In practice a few megabytes of text is comfortable.
Does it work offline?
Yes, once the page has loaded. The code that does the work is already in your browser at that point, so you can disconnect and keep using it. Reloading the page while offline needs the browser cache to still hold it.
Do I need to create an account?
No. There is no sign-up, no email, and no usage tracking tied to an identity. The tool works the first time you open it.