JWT Sign (HS256 / RS256) — A JSON Web Token (JWT) is three base64url segments: header.payload.signature. The header says which algorithm to use; the payload is your claims; the signature is the HMAC or RSA signature over the first two segments.
Signing runs entirely in your browser. The HMAC secret and RSA private key never leave this device.
Was JWT Sign (HS256 / RS256) useful?
What is jwt sign (hs256 / rs256)?
A JSON Web Token (JWT) is three base64url segments: header.payload.signature. The header says which algorithm to use; the payload is your claims; the signature is the HMAC or RSA signature over the first two segments.
This tool builds the header and payload in the browser, then signs with Web Crypto (HMAC for HS256, RSASSA for RS256). Nothing is sent to a server.
How to use it
-
Pick the algorithm
HS256 is a shared secret; pick it if both sides have the same secret. RS256 is asymmetric; pick it if the verifier only has a public key.
-
Add claims
Standard claims: sub (subject), iss (issuer), aud (audience), exp (expiration, Unix seconds), iat (issued at). Or add your own custom claims.
-
Provide the key
HS256: a shared secret string. RS256: paste a PKCS#8 PEM private key (including the BEGIN / END lines).
الأسئلة الشائعة
أدوات ذات صلة
JWT Decoder
Decode a JWT’s header and payload and check its expiration — without sending it anywhere.
HMAC Generator
Compute a Hash-based Message Authentication Code (HMAC) for any message and shared secret. Supports SHA-256, SHA-512, SHA-1, and MD5. All computation runs in your browser.
JSON Formatter
Format, beautify, and validate JSON with adjustable indentation — instantly in your browser.
Last reviewed: 2026-09-24