Create and sign JSON Web Tokens (JWT) with custom claims. Support for HS256, HS384, HS512 HMAC algorithms
Build a JWT from scratch by specifying the header algorithm, payload claims, and signing secret. The tool assembles the token in real time, letting you experiment with different claims and see the resulting encoded string. Perfect for generating test tokens during development.
Initializing in your browser…
Decode and inspect JSON Web Tokens (JWT). View header, payload, claims, expiration status, and signature without needing the secret key
Add your signature to PDF documents. Draw, type, or upload your signature, then position it anywhere on the page. Perfect for contracts, agreements, and official documents.
Generate QR codes from text or URLs
You are testing an authorization guard and need a signed HS256 token with a specific subject and a 1-hour expiry.
Claims + secret
sub: user_42 · role: admin · exp: +3600s · alg HS256 · secret "test-secret"
Signed token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwicm9sZSI6ImFkbWluIiwiZXhwIjoxNzAwMDAzNjAwfQ.<hmac-signature>
The builder encodes your header and claims, then signs `header.payload` with HMAC-SHA256 using your secret, producing a token your backend will accept as genuine in tests. `exp` is set as a Unix timestamp so you can deliberately mint already-expired tokens to exercise rejection paths. Signing happens locally; the secret is never sent anywhere.
Build a JWT from scratch by specifying the header algorithm, payload claims, and signing secret. The tool assembles the token in real time, letting you experiment with different claims and see the resulting encoded string. Perfect for generating test tokens during development.
Generate valid tokens to test authenticated endpoints without running a full auth server.
Quickly create tokens with specific claims to simulate different user roles and permissions.
Build sample tokens for API documentation that show exactly what claims are expected.
See how changing the payload or algorithm affects the final encoded token.
The builder lets you define standard claims (iss, sub, aud, exp, iat) alongside custom claims, then signs the token using HMAC-SHA256 or another selected algorithm. Since this runs in your browser, it is ideal for creating tokens for local development and testing, but never use browser-generated secrets for production signing keys.
The browser-based builder supports HMAC algorithms (HS256/384/512). Asymmetric algorithms like RS256 require key pair management that is better handled by server-side tools.
No. Use this for development and testing only. Production tokens should be issued by a proper auth server with securely managed keys.
The token will be valid indefinitely (until the signing key changes). It is best practice to always set a reasonable exp claim.
No. The entire signing process happens locally in your browser.
Conversions run on your device in JavaScript. The values you enter are never sent over the network.