AES Encryption Explained: How It Works and Why It Matters
Jun 23, 2026
JWT Token Generator
Create signed JSON Web Tokens with custom claims and algorithm selection.
- Home
- Hash & Security
- JWT Token Generator
Generated JWT Token
Header:
Payload:
Signature:
What is a JWT?
JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and authorization in web applications and APIs.
A JWT consists of three parts separated by dots: Header (algorithm & token type), Payload (claims/data), and Signature (verified integrity). Signatures can be symmetric (HMAC with a shared secret) or asymmetric (RSA/ECDSA with a private/public key pair).
Algorithm Selection Guide
HS256 / HS384 / HS512 (HMAC)
Symmetric algorithms using a shared secret key. The same key is used to sign and verify. Best for single-service applications where the verifier also knows the secret.
RS256 / RS384 / RS512 (RSA)
Asymmetric algorithms using a private key to sign and a public key to verify. The private key is never shared — only the public key is distributed. Ideal for microservices and third-party verification.
ES256 / ES384 / ES512 (ECDSA)
Asymmetric algorithms based on elliptic curve cryptography. Offer equivalent security to RSA with smaller key sizes. ES256 (P-256) is widely supported and recommended for new implementations.
How to Use
- Select your signing algorithm (HS256 for shared secret, RS256/ES256 for private key).
- Enter your secret key (for HMAC) or private key in PEM format (for RSA/ECDSA).
- Fill in the standard claims or add custom JSON claims.
- Click "Generate Token" to create your signed JWT.
- Copy the token and use it in your Authorization headers or wherever needed.
Frequently Asked Questions
Is signing done in my browser?
Yes. JWT signing is performed entirely in your browser using the Web Crypto API. Your secret keys never leave your device.
What is the difference between HS256 and RS256?
HS256 uses a shared secret — both the signer and verifier must know it. RS256 uses a private key to sign and a public key to verify, allowing anyone with the public key to verify without knowing the private key.
Can I use this token with my API?
Yes. Simply copy the generated token and include it in the Authorization: Bearer <token> header when making requests to your API.
How are the keys handled?
All operations are performed in your browser using JavaScript. No data is sent to any server. The Web Crypto API provides hardware-accelerated cryptographic operations for HMAC and the jose library handles RSA and ECDSA signing.
Related Security Tools
JWT Token Verifier
Decode and verify JWT signatures
JWT Decoder & Validator
Decode and validate JWT tokens
AES Encryption
Encrypt/decrypt with AES-256
RSA Key Generator
Generate RSA key pairs in PEM format
HMAC Generator
Generate HMAC signatures
Password Strength Checker
Test password strength and entropy
Last updated: 24 Jun 2026
Blog
Latest from Our Blog
CSS Gradient Generator: Create Stunning Gradients for Your Website
Jun 23, 2026
Diff Checker: How to Compare Text and Files Effectively
Jun 23, 2026
JSON Validation: How to Validate and Fix JSON Data
Jun 23, 2026
Regex Testing: How to Test and Debug Regular Expressions
Jun 23, 2026
SSL Certificate Checker: How to Verify SSL/TLS Certificates Online
Jun 23, 2026