JWT sign
Sign a JSON payload as a JWT with HS, RS, PS, ES or EdDSA algorithms, optionally adding issue and expiry times. Secrets and private keys are a separate input and are never saved with workflows.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Optional: Algorithm, HMAC secret format, Add issue time and more
Run
Processes in this browser; cancel at any time
About this tool
Create a signed JSON Web Token (JWT) from a JSON payload. Use it to make test tokens for an API in development, to reproduce a token your backend should accept, or to try out claims such as roles and expiry before you write the code.
It signs with HS256, HS384 and HS512 using a shared secret, or with the RS, PS, ES and EdDSA algorithms using a PEM private key or a JWK, and can add the issue time (iat) and an expiry (exp) for you. Signing runs in your browser: the payload and key are not uploaded, and the key is never saved with workflows.
How to use it
- Enter the claims as a JSON object in “Payload (JSON)” and the secret or private key in “Key (not saved with workflows)”. Use example loads a sample payload and the secret your-256-bit-secret.
- Choose the “Algorithm” (HS256 by default). For HS algorithms, also set the “HMAC secret format”.
- Leave “Add issue time” on to include iat, and set “Valid for” in seconds: 3600 is one hour, and 0 adds no expiry.
- Select Run, then preview the token and download it as token.txt.
Formats and limits
- Input
- Text
- Output
- Plain text
- Size limit
- 1 MB
- Settings
- Algorithm; HMAC secret format (Text, Hex, Base64); Add issue time; Valid for
- Privacy
- Text and keys stay in this browser session and are not uploaded. Keys are an input, so they are never saved with workflows or recipes.
- Price
- Free, no sign-up
Common questions
Which key does each algorithm need?
HS algorithms take a shared secret as text, hex or Base64, or an oct JWK; a PEM key is refused for them. RS, PS, ES and EdDSA need a private key: PEM in PKCS #8 or the traditional RSA/EC form, or a private JWK. Password-protected keys are not supported.
What if my payload already contains iat or exp?
With “Add issue time” on, iat is replaced by the current time, and a “Valid for” above 0 replaces exp with the current time plus that many seconds. To keep your own values, turn off “Add issue time” and set “Valid for” to 0.
What header does the token get?
The header holds only alg and typ, set to JWT. A key ID (kid) or other header fields cannot be added here.
Why is my key rejected?
RS and PS algorithms need an RSA key of at least 2048 bits, and the key must fit the algorithm, for example a P-256 key for ES256. You can make a suitable key with the “Key pair generator”.
How do I check the token afterwards?
Paste it into “JWT verify” with the same secret or the matching public key, or into “JWT decode” to read the payload. iat and exp are worked out from your device’s clock.
Related tools
JWT verify
Check a JWT’s signature with a secret, public key, certificate or JWK, and optionally its expiry and start times. Unsigned tokens and HMAC tokens checked against a public key are rejected.
JWT decode
Show a JWT’s header, payload and readable issue, start and expiry times without checking the signature.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
HMAC
HMAC of text with a secret key using MD5, SHA-1, SHA-2, SHA-3 or SM3. The key is a separate input and is never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.