What does this tool do?
JWT Generator creates a signed JSON Web Token from your own secret key and JSON payload using the HS256 (HMAC-SHA256) algorithm. It shows the header, payload, and signature in color and updates instantly as you type. It is built for developers who test APIs and need sample tokens on demand.
How to use it
- Choose the required options or length.
- Generate the secure result.
- Copy and store the result safely.
How signing works in your browser
The tool base64url-encodes the header and payload, joins them, and signs the result over SHA-256 using an HMAC key derived from your secret, all through the browser's built-in Web Crypto API. The output is a classic JWT made of three dot-separated parts: a red header, a yellow payload, and a green signature. Nothing is sent over the network, so your secret key and payload never leave your device.
The payload and standard claims
You can type any JSON you like into the payload field. The default example includes common claims such as subject (sub), name, issued-at (iat), and expiry (exp). The iat and exp values are Unix timestamps in seconds. If you enter invalid JSON, you see an error message and the token is not recomputed. The algorithm is currently fixed to HS256, which means symmetric signing with a shared secret key.
Frequently asked questions
Can I use these tokens in production?
No. The tool is for demo and testing only. In production you should create and verify tokens server-side and never share your secret key.
Which algorithm is supported?
Only HS256, that is HMAC-SHA256 symmetric signing with a shared secret. Public/private key algorithms such as RS256 are not supported.
How do I set the token's expiry?
Set the exp claim in the payload as a Unix timestamp in seconds. The default example includes an exp value set to one hour from now.
Is JWT Generator free?
Yes. JWT Generator and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. JWT Generator works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.