JWT Generator
Build and sign a JSON Web Token in your browser — pick an HMAC secret or sign RS256 and ES256 by pasting a PKCS#8 PEM private key, then edit the header and claims.
Web Crypto
RS256 needs an RSA key; ES256 needs a P-256 key. Generate one with the key pair tool.
How to generate a JWT
Build, sign, and copy a token in four steps.
- 1
Pick an algorithm
Choose HS256, HS384, or HS512. The header’s alg field updates automatically to match your selection.
- 2
Edit the header and claims
Adjust the JSON payload with your subject, issuer, expiry, and any custom claims, then fine-tune the header if you need to.
- 3
Enter your secret and copy
Type the HMAC secret to sign with. The signed token appears instantly — copy it with one click.
- 4
Manage the real secret in Envless
Store and rotate the actual signing secret end-to-end encrypted in Envless instead of hardcoding it, so your team can share and audit it without plaintext exposure.
Why use the Envless JWT generator?
Real Web Crypto signing from a team that builds encrypted secret management for a living.
HMAC signing with Web Crypto
Tokens are signed with the browser’s native Web Crypto HMAC implementation using HS256, HS384, or HS512 — the same primitives your backend libraries rely on.
Editable header and payload
Tweak the JSON header and payload claims directly. The token re-signs as you type, so you always see a valid, copy-ready result.
Custom claims and expiry
Add any registered or private claims you need, including iat, exp, and nbf timestamps, to model exactly how your API expects tokens to look.
100% client-side
Your secret and the signed token never leave the page. There are no uploads, no logging, and no network requests — everything runs on your device.
RS256 and ES256 with a PEM key
Beyond HMAC, paste a PKCS#8 PEM private key to sign an RS256 or ES256 JWT locally with the Web Crypto API — ideal when your API verifies tokens with a matching public key.
JWT generator FAQ
Everything you need to know about building and signing JSON Web Tokens locally.
No. The generator runs 100% in your browser using the Web Crypto API. Your secret, claims, and the signed token never leave your device — there are no uploads, no logging, and no network requests.
A JSON Web Token is a compact, URL-safe token made of three Base64url parts — a header, a payload of claims, and a signature. It’s widely used to authenticate API requests and pass verified user information between services.
This tool signs with the HMAC family — HS256, HS384, and HS512 — using a single shared secret, plus the asymmetric algorithms RS256 and ES256, which you sign by pasting a PKCS#8 PEM private key. All signing happens locally with the Web Crypto API.
Because everything is computed locally, your secret is never transmitted or stored. Even so, avoid pasting production secrets into any tool on a shared or untrusted machine — test with a throwaway secret and keep real ones in a manager like Envless.
Yes. The payload is fully editable JSON, so you can add standard claims like exp, iat, nbf, iss, and aud alongside any private claims your application needs.
Keep them out of source code. Store the issuer’s signing secret end-to-end encrypted in Envless so your team can share, rotate, and audit access without hardcoding it or pasting it into chat.
Yes. Alongside the HMAC family, you can paste a PKCS#8 PEM private key and sign an RS256 or ES256 token entirely in your browser. The RS256 JWT is signed locally with the Web Crypto API, and your private key is never uploaded or stored.
More free tools
Other free, 100% client-side tools from the Envless team.
Ship secrets, not chaos.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.