What does JWT Signer actually do?

The JWT signer builds a compact token from a header, a payload, and a secret you provide, using the HMAC algorithm the form supports. It does not prove your production server will accept the token. The secret never needs to be uploaded for the signature to be computed here.

When should I use JWT Signer?

Use it to mint a short-lived test token against a local secret.

When should I not use JWT Signer?

Do not paste a production signing key into a browser tool.

What does JWT Signer not do?

Signing in the browser with a production secret exposes that secret to the page and extensions. RS256 and other asymmetric algs are not implied unless the form lists them.

JWT Signer

Sign JWTs with HS256 / HS384 / HS512 using the browser's native Web Crypto API. Free online — runs locally, no upload.

Algorithm

Secret

Payload (JSON)

Signing uses the browser's native Web Crypto API (HMAC with SHA-256 / SHA-384 / SHA-512). The secret never leaves your browser. Asymmetric algorithms (RS256, ES256) are not supported in this version.

Search tools

JWT Signer