JWT Sign

Overview

Write the claims as JSON, pick HS256, HS384 or HS512, type the shared secret, and you get the finished token as one string. The header is built for you. All three algorithms use a single shared secret, so there is no key pair to manage. Signing runs on your browser's own Web Crypto.

API Auth During DevelopmentSign a token with your service's secret and call a protected endpoint, without setting up an auth service first.
Learning What a Token IsChange a claim, sign again and compare: the header and payload are plain text, and only the signature depends on the secret.
Prototyping Custom ClaimsTry out a payload shape, with roles, tenant IDs or scopes, before you build it into your code.
Reproducing an Auth FailureRebuild a rejected token with the same expiry, issuer or subject and a known secret, so you can reproduce the failure on demand.
Test Fixtures for CISign tokens with a known secret to get repeatable fixtures for integration tests.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.jwt_sign
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Write the payload

Enter the claims as JSON, and the header is built for you from the algorithm you pick.

Choose the algorithm and the secret

Pick HS256, HS384 or HS512 and type the shared secret to sign with.

Take the token

Copy the finished token into an Authorization header, a test fixture or your API client.

Frequently asked

What is a JWT and why sign it?

A JSON Web Token carries claims, such as who the subject is and when it expires, as Base64url text anyone can read. The signature proves those claims have not been changed since someone with the secret signed them.

Which signing algorithm can I use?

HMAC only: HS256, HS384 or HS512. All three use one shared secret to sign and verify, and HS256 is the usual default. Asymmetric algorithms such as RS256 and ES256 need a key pair and are not supported here.

Is my secret safe to paste?

Your secret is used in your browser and never sent anywhere, logged to the console or stored. A development secret is safe to paste. Treat a production secret with the same care as any other production credential.

What claims should I include?

Common ones are 'sub' (subject), 'exp' (expiry), 'iat' (issued at) and 'iss' (issuer). Add any custom claims your service reads, like roles, tenant ID or scopes.

How long should a JWT be valid?

Short-lived tokens (15–30 minutes) limit the damage if one leaks. Longer ones are more convenient but stay usable after access should have ended. Use a refresh token to keep sessions long while access tokens stay short.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/