JWT Signer — Browser HS256 Token Generator
DeveloperA JWT signer is a browser developer tool that base64url-encodes JSON header and payload values, then appends an HMAC-SHA256 signature to create an HS256 JSON Web Token.
What is it
A JWT (JSON Web Token) has three dot-separated parts: header, payload, and signature. This tool supports only the common symmetric HS256 algorithm. It normalizes the header and payload JSON, then signs the input with the browser Web Crypto API. It is useful for test tokens, documentation examples, and local debugging, but avoid pasting production secrets on shared devices or during screen sharing.
How to use
- 1Review the header JSON. alg is fixed to HS256.
- 2Enter the payload JSON and secret.
- 3Generate the token, then verify it with a JWT decoder or your server validation logic.
Reference
| Field | Value | Notes |
|---|---|---|
| alg | HS256 | HMAC-SHA256 symmetric signature |
| typ | JWT | token type |
| secret | string | shared signing secret, used only in this browser |
Sources & standards
- RFC 7519: JSON Web Token (JWT) - IETF
- RFC 7515: JSON Web Signature (JWS) - IETF
- Web Crypto API: SubtleCrypto.sign() - MDN Web Docs
- MDN Web Docs: Client-side web APIs - MDN Web Docs
FAQ
Is the JWT secret sent to a server?
No. Signing uses the browser Web Crypto API; the secret and payload are not sent to or stored on a server.
Does it support RS256 or ES256?
No. This scoped tool supports HS256 only to keep key handling and bundle size small. RSA/ECDSA signing belongs in a separate tool.
Can I use generated tokens directly in production?
This does not replace your production token issuing policy. Validate issuer, audience, expiry, rotation, and revocation on the server.