JWT Generator

Building a JWT is the mirror image of verifying one: instead of checking a signature against a key, you compute a fresh signature with it. The header and payload are base64url-encoded and joined with a dot, and that string is signed to produce the third part — the exact process this tool automates for you, for both symmetric algorithms (HMAC, where the same secret signs and verifies) and asymmetric ones (RSA and ECDSA, where a private key signs and only the matching public key can verify).

This tool picks the header for you based on the algorithm you choose — you only write the payload, the claims that actually carry your data. Signing happens entirely client-side using your browser's Web Crypto API; nothing you type, including a secret or private key, is ever sent anywhere.

• •Use a throwaway secret or key pair when experimenting — even though signing happens locally in your browser, it's a good habit never to type a real production credential into a general-purpose tool.
• •For RSA and ECDSA, this tool needs the private key (not the public key) in PKCS#8 PEM format — the block starting with "-----BEGIN PRIVATE KEY-----". Older formats like "-----BEGIN RSA PRIVATE KEY-----" need converting first.
• •Set exp thoughtfully: a payload with no exp claim produces a token that never expires by JWT's own rules, which is rarely what you want for a session or access token.
• •Generate a token here, then paste it straight into the JWT Decoder or Verifier tool to confirm it decodes and verifies the way you expect — a quick round-trip catches most mistakes immediately.