JWT Builder & HMAC Signer

What is the JWT Builder & HMAC Signer?

This tool builds a JWT from a header and payload you edit as JSON, then signs it with HMAC-SHA256 using a secret you type in — entirely inside your browser.

How it works

It Base64url-encodes the header and payload, forces the header's alg to HS256 (overriding anything else you type, since that's the only algorithm it actually signs with), and uses the WebCrypto crypto.subtle.importKey/sign functions to compute an HMAC-SHA256 signature over the encoded header and payload with your secret as the key. The token re-signs automatically on every keystroke.

SysAdmin & security use cases

• »Craft a token with a custom claim, like admin: true, to test whether a backend actually checks it.
• »Generate a short-lived token with a specific exp claim to test session-expiry handling.
• »Sign a test JWT with a known secret for local development without exposing a real signing key.
• »See exactly how editing a claim changes the resulting signature.