Last updated October 5, 2026 · Report an error
JSON Web Tokens are the backbone of modern stateless authentication, but hand-building the base64url-encoded header, payload, and HMAC signature correctly is fiddly to do manually. This generator builds a complete, correctly signed JWT from a JSON payload, secret key, and HMAC algorithm, with a full step-by-step solution.
How it works
Enter your JSON payload, a secret key, and choose an HMAC algorithm (HS256, HS384, or HS512). Optionally set an expiration time. The generator base64url-encodes the header and payload, signs the result with HMAC using your secret, and assembles the final token.
- Enter payload (JSON).
- Enter secret key.
- Enter algorithm.
- Enter expires in (minutes, optional).
- Click Calculate to see your results.
Examples
A simple signed token
A payload of {"sub": "1234567890", "name": "John Doe"} signed with HS256 produces a three-part token: header.payload.signature.
Who should use it
- Generating a test JWT for developing or debugging an API that requires token-based authentication.
- Learning how JWT structure and signing works for educational purposes.
Industry applications
- API authentication and authorization systems
- Software development and testing
Advantages
- Supports all three standard HMAC algorithms (HS256, HS384, HS512).
- Optionally adds standard iat/exp claims automatically when an expiration is set.
Limitations
- Only supports HMAC (symmetric secret) signing, not RSA/ECDSA (asymmetric key pair) algorithms.
Common mistakes to avoid
- Using a real production secret key with any online generator — always use a throwaway test secret and rotate real secrets that may have been exposed.
- Forgetting that JWTs are signed, not encrypted — anyone can decode and read the payload without the secret, they just can't forge a valid signature without it.
Best practices
- Never store sensitive data directly in a JWT payload, since the payload is only base64-encoded (readable by anyone), not encrypted.
Tips
- For production systems, generate and rotate secrets using a proper secrets manager rather than any online tool, and prefer a strong, randomly generated secret of sufficient length.