# JWT Signer

> Create a signed HS256, HS384 or HS512 JSON Web Token for testing, entirely in your browser.

A JWT signer builds a JSON Web Token by base64url-encoding a header and payload, then appending an HMAC signature computed with your secret. This tool supports HS256, HS384 and HS512, adds standard iat, exp, iss and sub claims, and warns when the secret is shorter than RFC 7518 requires.

**URL:** https://convertto.tech/t/jwt-signer
**Category:** Hash & Crypto Tools (https://convertto.tech/c/crypto-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Signing:** HMAC via the browser WebCrypto API — the secret never leaves your device
- **Not encryption:** A JWT payload is encoded, not encrypted, and is readable by anyone holding the token
- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter or paste your payload claims.
2. Enter the signing secret — it stays in your browser and is never sent anywhere.
3. Choose the algorithm.
4. Set the expires in.
5. Enter or paste your issuer (iss).
6. Enter or paste your subject (sub).
7. Press Run, then download the result when it is ready.

## FAQ

### Is a JWT payload secret?

No. It is base64url encoding, which is reversible by anyone. The signature proves the token was not altered; it does not hide the contents. Never place a password, key or personal data you would not publish in a payload.

### How long should my HMAC secret be?

RFC 7518 requires a key at least as long as the hash output — 256 bits for HS256, 384 for HS384, 512 for HS512. A short human-chosen secret can be brute-forced from a single captured token.

## Related tools

- [JWT Verifier](https://convertto.tech/t/jwt-verifier): Verify a JWT's HS256 signature and its expiry, issuer and audience claims, entirely in your browser.
- [JWT Decoder](https://convertto.tech/t/jwt-decoder): Decode a JSON Web Token to inspect its header, payload and expiry — locally, never sent anywhere.
- [HMAC Generator](https://convertto.tech/t/hmac-generator): Generate an HMAC signature with SHA-256, SHA-1, SHA-384 or SHA-512 and a secret key.
- [TOTP Code Generator](https://convertto.tech/t/totp-generator): Generate time-based one-time passwords from a Base32 secret to test 2FA setups.
- [Edge Case Test String Generator](https://convertto.tech/t/edge-case-string-generator): Generate the strings that break input handling — Unicode, RTL, emoji, injection patterns and boundary lengths.
- [Regex Tester](https://convertto.tech/t/regex-tester): Test regular expressions against sample text and see every match with its capture groups.
- [Sample Dataset Generator](https://convertto.tech/t/sample-dataset-generator): Download ready-made sample datasets — users, orders, products, transactions — as CSV, JSON, SQL or Excel-ready TSV.
- [Sign PDF Document](https://convertto.tech/t/sign-pdf): Draw your signature, drag it onto the page and save a signed PDF — without uploading anything.