JWT builder

Developer tools

Loading tool

Preparing the tool. The remaining time is not yet known.

All processing for this tool happens in your browser. Your input is not sent to a server.

About this tool

Create a compact, HMAC-signed JWT from JSON objects and a text secret in your browser. Choose HS256, HS384 or HS512; Web Crypto signs the Base64url Header.Payload bytes. Use this for controlled test fixtures, then inspect the result in the JWT decoder. Creating a signature does not validate claims or authorize a user.

Common uses

Generate reproducible HMAC tokens for local API and integration tests.
Compare HS256, HS384 and HS512 signing with the same test claims.
Inspect the signing input to understand how JSON bytes affect a JWT signature.

How to use it

1.Enter Header and Payload as JSON objects, then select HS256, HS384 or HS512.
2.Enter a test secret as text; the exact UTF-8 bytes are used, not decoded Base64 or hexadecimal.
3.Build the JWT, copy the token, or expand the signing input. The selected algorithm replaces Header.alg; a string typ is preserved, otherwise typ becomes JWT.

Examples

Reproducible HS256 test token

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "user-42",
    "iat": 1700000000
  },
  "algorithm": "HS256",
  "secret": "demo-only-key-do-not-use-in-production"
}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwiaWF0IjoxNzAwMDAwMDAwfQ.fskbbfT8Y-3vjXSxYDdc-fa23GdUmhivjVOFM9NWx8w

Copy header and payload into their fields, choose algorithm and enter secret exactly as shown. This public demo key is for tests only.

HS512 with Unicode JSON

{
  "header": {
    "alg": "HS512",
    "typ": "JWT"
  },
  "payload": {
    "name": "你好 / 日本語"
  },
  "algorithm": "HS512",
  "secret": "demo-only-key-do-not-use-in-production"
}

eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoi5L2g5aW9IC8g5pel5pys6KqeIn0.6D1s9ZGSyIcSKLrHkt0c-TQ5z-EXQBbca1LyIGKjSD5nTsgjVxvxt9YDGLSLWJ_hp4GxYVemJchQ7XfXNV6xmQ

UTF-8 claims are encoded before HMAC signing. The public example secret is deliberately a test fixture, not a production key.

Common errors and checks

Empty JSON, trailing commas, arrays and null cannot be used as Header or Payload objects.
An empty secret, a secret exceeding 4,096 UTF-8 bytes, or missing Web Crypto prevents signing.
Do not paste a production secret or reuse the public demo key. A token carries readable claims even when signed.

Limits and notes

HMAC signing only: no RS256, ES256, EdDSA, unsigned alg:none or JWE encryption.
Each JSON input is limited to 65,536 JavaScript string code units; the secret is limited to 4,096 UTF-8 bytes.
Web Crypto must be available in a secure context such as HTTPS or localhost.
Claims are not validated and no expiry is added automatically. Payload data remains readable; signing is not encryption.
This tool accepts short secrets for testing and does not enforce production key strength. RFC 7518 requires at least 256, 384 or 512 key bits for HS256, HS384 or HS512 respectively; use securely generated keys and your application’s vetted library.

Frequently asked questions

Does the builder really sign the token?

Yes. It computes an HMAC over the Base64url Header.Payload string with the chosen SHA-256, SHA-384 or SHA-512 hash, then appends the encoded MAC.

Why does the signature differ from another tool?

Compare the exact UTF-8 secret, selected algorithm and serialized Header/Payload bytes. Whitespace is compacted, key order can matter, and alg is set by the selector.

Can a generated token be trusted in production?

Generation alone proves nothing about authorization. A relying application must verify the signature with its own trusted key and validate the expected claims and algorithm.