JWT Signer
Build a JWT header and payload and sign it with HMAC (HS256/384/512) or an RSA/ECDSA private key (RS/PS/ES) — entirely in your browser. Nothing is uploaded.
Prefer the terminal? See the CLI equivalent →About the JWT Signer
- HS, RS, PS & ES signing
- Syntax highlighting
- Send to the JWT Debugger
- Instant results
- 100% private — runs in your browser
- Free, no sign-up
Compose a JSON Web Token from scratch: edit the header and payload as JSON, choose an algorithm, provide the key, and get a signed token instantly. It is the counterpart to the JWT Debugger — build a token here, then open it there to inspect and verify it.
HMAC algorithms (HS256/384/512) sign with a shared secret; RSA and ECDSA algorithms (RS/PS/ES) sign with a PKCS#8 PEM private key. Signing uses the browser’s built-in Web Crypto API — the same primitives the debugger uses to verify.
Everything happens locally. Your secret or private key is never uploaded, never logged, and — unlike the token — never placed in a shareable link. Only the finished token, a public bearer value, can be shared or handed to the debugger.
How to use it
- Edit the header and payload JSON — the payload holds your claims (sub, iat, exp, …).
- Pick the signing algorithm; the header’s "alg" updates to match.
- Enter the shared secret (HS*) or paste a PKCS#8 PEM private key (RS/PS/ES).
- Copy the signed token, or send it straight to the JWT Debugger to verify it.
Algorithm families
- HS256 / HS384 / HS512
- HMAC with a shared secret — the same secret signs and verifies.
- RS256 / RS384 / RS512
- RSASSA-PKCS1-v1_5 with an RSA private key.
- PS256 / PS384 / PS512
- RSA-PSS (randomized padding) with an RSA private key.
- ES256 / ES384 / ES512
- ECDSA on P-256 / P-384 / P-521 with an EC private key.
Frequently asked questions
Is my secret or private key uploaded?+
No. Signing runs entirely in your browser via the Web Crypto API. The key is used only to compute the signature and is never sent anywhere, never logged, and never added to the shareable URL — only the resulting token can be shared.
What key format do the RSA/ECDSA algorithms need?+
A PKCS#8 PEM private key — the block that begins with "-----BEGIN PRIVATE KEY-----". Web Crypto imports keys in PKCS#8, so PKCS#1 ("BEGIN RSA PRIVATE KEY") or SEC1 ("BEGIN EC PRIVATE KEY") keys must be converted to PKCS#8 first.
Why does the header always show the algorithm I picked?+
The selected algorithm is authoritative and is stamped into the header before signing, so the token can never advertise an algorithm different from the one that actually signed it — a common source of algorithm-confusion bugs.
Should I sign real production tokens here?+
This tool is built for development, testing, and learning. Although keys never leave your browser, production signing keys should stay in your server or secrets manager — generate throwaway or test keys for experimenting here.
Works well with
JWT Signer chains with these tools — send your result straight on:
Related tools
ASN.1 Decoder
Decode ASN.1 DER/BER — paste PEM, Base64, or hex and see the tag–length–value tree behind X.509 certificates, keys, and CMS, entirely in your browser.
Certificate Decoder
Decode X.509 / PEM certificates — view subject, issuer, validity, SANs, key, and fingerprints, all in your browser.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or a file, plus HMAC — all at once, entirely in your browser.
JWT Debugger
Decode and inspect JSON Web Tokens: view the header and payload, check expiry, and verify HS/RS/PS/ES signatures — all in your browser.
Metadata Inspector
Inspect the hidden metadata in a photo or document — EXIF, GPS location, author, dates, and more — right in your browser. Download a cleaned copy with the metadata removed.
Metadata Stripper
Strip EXIF, GPS, author, and hidden metadata from images and documents in one batch — locally in your browser. JPEG, PNG, WebP, GIF, PDF, Office, OpenDocument & EPUB.