Skip to content
Convertto

JWT Signer

Create a signed HS256, HS384 or HS512 JSON Web Token for testing, entirely in your browser.

A JWT signer builds a JSON Web Token by base64url-encoding a header and payload, then appending an HMAC signature computed with your secret. This tool supports HS256, HS384 and HS512, adds standard iat, exp, iss and sub claims, and warns when the secret is shorter than RFC 7518 requires.

Runs in your browser
Signing
HMAC via the browser WebCrypto API — the secret never leaves your device
Not encryption
A JWT payload is encoded, not encrypted, and is readable by anyone holding the token
Privacy
Runs entirely in your browser — nothing is uploaded
Cost
Free, unlimited, no sign-up

Frequently asked questions

Is a JWT payload secret?

No. It is base64url encoding, which is reversible by anyone. The signature proves the token was not altered; it does not hide the contents. Never place a password, key or personal data you would not publish in a payload.

How long should my HMAC secret be?

RFC 7518 requires a key at least as long as the hash output — 256 bits for HS256, 384 for HS384, 512 for HS512. A short human-chosen secret can be brute-forced from a single captured token.

How to use the jwt signer

  1. 1Enter or paste your payload claims.
  2. 2Enter the signing secret — it stays in your browser and is never sent anywhere.
  3. 3Choose the algorithm.
  4. 4Set the expires in.
  5. 5Enter or paste your issuer (iss).
  6. 6Enter or paste your subject (sub).
  7. 7Press Run, then download the result when it is ready.

Embed this tool

Put the working jwt signer on your own site. It runs in your visitors' browsers exactly as it does here — free, no account, nothing uploaded.

Share this tool

Related tools

JWT VerifierVerify a JWT's HS256 signature and its expiry, issuer and audience claims, entirely in your browser.JWT DecoderDecode a JSON Web Token to inspect its header, payload and expiry — locally, never sent anywhere.HMAC GeneratorGenerate an HMAC signature with SHA-256, SHA-1, SHA-384 or SHA-512 and a secret key.TOTP Code GeneratorGenerate time-based one-time passwords from a Base32 secret to test 2FA setups.Edge Case Test String GeneratorGenerate the strings that break input handling — Unicode, RTL, emoji, injection patterns and boundary lengths.Regex TesterTest regular expressions against sample text and see every match with its capture groups.

Last updated

More hash & crypto tools