Can this generate a token signed with RS256 or another asymmetric algorithm?

No, only the HMAC family (HS256, HS384, HS512) is supported. Those need just one shared secret this tool can hold entirely client-side; RS256 and similar need a private key pair, a different trust model than typing a secret into a browser tool.

What do the "Set iat to now" and "add exp" buttons actually do?

They edit the payload JSON directly: setting iat to the current Unix timestamp, or adding an exp a chosen number of hours after iat, rather than tracking those as separate fields outside the payload you can see and edit.

JWT Generator: Create Signed JSON Web Tokens Online

Payload (JSON)paste or type · or drop a .json file

Browse

Secret KeyHMAC · HS256

Generated JWT

Generated token will appear here…

Signed using the Web Crypto API. Your secret never leaves the browser

What is a JSON Web Token?

A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit information between parties. It consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims such as user ID, roles, and expiry), and the signature.

The signature is computed by hashing the header and payload with a secret key, allowing the receiver to verify that the token was not tampered with. JWTs are stateless: all the information needed to authenticate a request is contained within the token itself.

HS256 vs HS384 vs HS512

All three are HMAC algorithms that use a shared secret key — the number is the SHA hash size in bits. HS256 is by far the most common: fast, widely supported, and secure as long as the secret is strong (at least 256 bits of entropy). For asymmetric signing, use RS256 or ES256 instead — those need a key pair and aren't covered by this tool.

HS25632-byte signature — the common default

HS38448-byte signature — rarely needed

HS51264-byte signature — rarely needed

Standard JWT claims

All registered claims are optional. The iat = now and + exp 1h buttons above are shortcuts for the two most commonly set ones during development and testing.

issIssuer — who issued the token

subSubject — usually a user ID

audAudience — the intended recipient

expExpiration time — Unix timestamp

nbfNot before — Unix timestamp

iatIssued at — when the token was created

jtiJWT ID — unique, prevents replay attacks

Frequently asked questions

No. Signing runs through the Web Crypto API's native HMAC implementation directly in your browser. The secret and the resulting token never leave the page.