Browser 106

no file limit

Inspector security/jwt-sign

JWT Sign

Overview

Write the claims as JSON, pick HS256, HS384 or HS512, type the shared secret, and you get the finished three-part token as a single string — ready to drop into an Authorization header, a test fixture, or a request in an API client. The header is assembled for you from the algorithm you chose. HMAC is the only family here: all three variants sign and verify with one shared secret, so there is no key pair to generate or manage. Signing runs on the browser's own Web Crypto, so the payload and the secret stay on your device and reach no server, which is what makes it safe to paste a real development secret rather than a stand-in.

API Auth During DevelopmentSign a token with the same secret your service uses, then call a protected endpoint with it, without standing up an auth service first.
Learning What a Token IsChange one claim, sign again, and watch which of the three dot-separated segments moves — the fastest way to see that the header and payload are readable text and only the signature depends on the secret.
Prototyping Custom ClaimsTry out the shape of a payload — roles, tenant IDs, scopes — before committing it to code and to every token your service will ever issue.
Reproducing an Auth FailureRecreate the exact conditions of a token that was rejected: a specific expiry, issuer or subject value, signed with a known secret, so the failure can be reproduced on demand.
Test Fixtures for CISign tokens with a known secret to get deterministic fixtures for integration tests that need an authenticated request.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.jwt_sign
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Write the payload

Enter the claims as JSON — subject, expiry, issuer, and whatever else your service reads. The header is assembled for you from the algorithm you choose.

Choose the algorithm and the secret

HS256, HS384 or HS512, signed with a shared secret you type in. The secret is used in your browser and is not sent anywhere, so a real development secret is safe to paste.

Take the token

You get the finished three-part token as a single string, ready to drop into an Authorization header, a test fixture, or a request in your API client.

Frequently asked

What is a JWT and why sign it?

A JSON Web Token carries a set of claims — who the subject is, when the token expires, who issued it — as Base64url text that anyone can read. The signature is what makes it trustworthy: it proves the claims have not been edited since they were signed by someone holding the secret.

Which signing algorithm can I use?

HMAC only: HS256, HS384 or HS512. All three use a single shared secret for both signing and verifying, and differ just in the digest underneath; HS256 is the usual default. Asymmetric algorithms such as RS256 and ES256 need a key pair and are not produced here.

Is my secret safe to paste?

The secret you type is used by your browser and is not sent anywhere — no server sees it, and it is not written to the console or to storage. A development secret is safe to paste. Treat a production signing secret with the same care you would give any other production credential.

What claims should I include?

Common ones are 'sub' (the subject), 'exp' (expiry), 'iat' (issued at) and 'iss' (the issuer). Add whatever custom claims your service reads — roles, tenant ID, scopes. The header is assembled for you from the algorithm you pick, so it is not something you write.

How long should a JWT be valid?

Short-lived tokens (15–30 minutes) limit the damage if one leaks; longer ones are more convenient but stay usable after access should have ended. A refresh token is the usual way to keep sessions long without keeping access tokens long.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools