How to use the JWT Generator (HS256)
1. Edit the Header and Payload JSON. Common claims: sub (subject), iat (issued at), exp (expiration as Unix timestamp).
2. Enter your HMAC secret. For HS256, this should be a long random string.
3. Click Sign JWT — the token is generated entirely in your browser using WebCrypto.
What is it?
A JWT (JSON Web Token) has three parts separated by dots: a base64url-encoded header, a base64url-encoded payload, and a signature. For HS256, the signature is HMAC-SHA256 of "header.payload" keyed with the secret.
This tool generates HS256 tokens (symmetric signing — same key to sign and verify). For RS256/ES256 (asymmetric), you need a private/public key pair.
Benefits
Verify data integrity instantly
Hash comparison confirms whether a file, API response, or downloaded binary has been altered in transit or at rest — without storing the original content.
Authenticate requests and webhooks
HMAC signatures prove a request came from a trusted source and was not modified in transit — the mechanism behind Stripe, GitHub, and AWS webhook security.
Protect sensitive data at rest
AES-256 encryption makes stored content unreadable to anyone without the key — even if your database, S3 bucket, or file system is fully compromised.
Generate credentials that meet security standards
Cryptographically random output from the Web Crypto API satisfies NIST entropy requirements — unlike predictable Math.random()-based alternatives.
Frequently asked questions
What is iat and exp?
iat is 'issued at' — a Unix timestamp of when the token was created. exp is 'expiration time' — a Unix timestamp after which the token is invalid. Both are in seconds since epoch.
Is this the same as what my backend generates?
Yes — if your backend uses HS256 with the same secret, payload, and header, it will produce the same token (given the same iat/exp values).