Generate HS256 JWTs to compare with server libraries or teach how compact signatures work. Keep production secrets off shared machines.
Secret
Header (JSON)
Payload (JSON)
JWT
Related tools
How it works
Header and payload are Base64url-encoded, concatenated, and signed with HMAC-SHA256.
The signature is Base64url-encoded and appended as the third segment.
Production
Issue tokens on the server with audited libraries; this page is for learning and debugging.
Secrets
Typing a production secret in a web page is risky. Prefer dev keys only.
Common questions
- RS256?
- Not supported here. Only symmetric HS256.
- exp claim?
- Add it in payload JSON yourself; this tool does not set defaults.
- kid header?
- Include any fields you need in the header JSON.
- Verification?
- Use your stack’s JWT library; this tool only signs.