Tool description

This tool creates and signs JWTs in your browser. Pick an algorithm, edit the header and payload as JSON, and the signed token appears right away. It is handy for testing an API, trying out a new auth setup, or making a token for a local environment. Everything happens in your browser with the Web Crypto API, and your secrets and keys are not sent anywhere.

When you open the tool, it makes a random secret, and it makes a new key pair the first time you pick an algorithm that needs one, so you get a working token without preparing anything. Paste your own secret or private key to make tokens your server accepts.

Features

  • Signs with HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, and EdDSA (Ed25519).
  • Takes the HMAC secret as text, Base64, or hex, and warns when it is shorter than RFC 7518 allows, which many libraries refuse.
  • Reads private keys as PKCS #8 PEM (BEGIN PRIVATE KEY), PKCS #1 PEM (BEGIN RSA PRIVATE KEY), SEC 1 PEM (BEGIN EC PRIVATE KEY), or JWK.
  • Shows the public key as PEM and as a JWK with kid, use, and alg, ready to add to a JWKS.
  • Sets exp, iat, nbf, and a random jti when the token is signed, and shows the signing and expiry times in your time zone.
  • Explains what is wrong with a key: a public key instead of a private one, a key of the wrong type or curve, an RSA key under 2048 bits, or a key protected with a password.
  • Keeps one key for each key type, so you can switch between RS256 and ES256 without losing the key you pasted.
  • Makes unsigned tokens with alg set to none, to test that your server rejects them.

Examples

With HS256, the header {"typ": "JWT"}, the payload {"sub": "1234567890", "name": "Jane Doe"}, and "Expires in" set to 1 hour, the signed payload becomes:

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1790000000,
  "exp": 1790003600
}

Tips

The token is signed again whenever you change something, so iat and exp always count from the current time. Use the button under the token to sign it again without changing anything.