# JWT Generator (HS256)

URL: https://phishdestroy.io/developer-tools/jwt-generator
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Sign a JSON payload with a shared secret and get a compact HS256 JSON Web Token. Use it to build test tokens, for example to check that your API rejects a token signed with the wrong secret or past its exp time.

## Example input

jwt.io sample payload

```
{"sub":"1234567890","name":"John Doe","iat":1516239022}
```

With the default secret my-secret-key the token ends in MRvO3fE0o9C-pZfd3pI0hMDDXihJfQa1XPQ-UAelzaI; with the secret your-256-bit-secret it matches the well-known jwt.io sample token ending in SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c.

## FAQ

### How is the token built?

The header {"alg":"HS256","typ":"JWT"} and your payload, re-serialised as compact JSON, are Base64url-encoded and joined with a dot. The signature is HMAC-SHA-256 over that string with your secret, computed by the Web Crypto API.

### What does it not do?

Only HS256 is available. The secret is used as UTF-8 text (a Base64-encoded key is not decoded first), and claims such as iat or exp are neither added nor checked, so set them in the payload yourself.

### Is my secret sent anywhere?

No. Signing runs locally through crypto.subtle, and the secret and payload are not uploaded or stored. Use test secrets only, never the signing key of a production system.

## Related tools

- [JWT Decoder](https://phishdestroy.io/developer-tools/jwt-decoder)
- [HMAC Generator](https://phishdestroy.io/developer-tools/hmac-generator)
- [Base64 Encoder / Decoder](https://phishdestroy.io/developer-tools/base64-encoder-decoder)
- [API Key & Token Generator](https://phishdestroy.io/developer-tools/api-token-generator)
- [Unix Timestamp Converter](https://phishdestroy.io/developer-tools/unix-timestamp-converter)

All tools: https://phishdestroy.io/developer-tools