● signed entirely in your browser via the Web Crypto API
JWT encoder
Build a JWT (HS256) with a real HMAC-SHA256 signature - useful for testing an API locally. Your secret is never sent anywhere.
How it works
The header { alg: "HS256", typ: "JWT" } and your JSON payload are each base64url-encoded and joined with a dot to form the signing input, then your secret is imported as an HMAC key with crypto.subtle.importKey() and used to sign that string with crypto.subtle.sign() — the Web Crypto API's real cryptographic implementation, not a hand-written HMAC. The resulting signature is base64url-encoded and appended as the token's third segment.
FAQ
Can I sign a token with a different algorithm, like RS256?
No — this tool only produces HS256 (HMAC-SHA256) tokens; the header is hardcoded to that algorithm. RS256 and other asymmetric algorithms need a public/private key pair rather than a single shared secret, which is a different signing flow entirely.
Is the signature this produces cryptographically real, or just a demo?
It's real — the signature is generated with the Web Crypto API's standards-based HMAC-SHA256 implementation, so a backend configured with the same secret will verify this token as valid, the same as one it generated itself.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.