# JWT Generator Online - Create, Sign and Verify JWTs with HS256, RS256, ES256 and PS256

> Free online JWT generator: edit the header and payload, sign with HS, RS, PS or ES 256/384/512, make RSA / EC key pairs, and verify with exp/nbf checks locally.

- URL: https://qilingtools.com/en/jwt-generate
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Building authentication, debugging an API gateway or writing integration tests often means you need a JWT with specific claims and a specific algorithm. Edit the header and payload JSON, pick an algorithm and key, and the token is signed live. HMAC (HS256/384/512) accepts text, Base64 or hex secrets and warns when a secret is shorter than RFC 7518 requires. RSA (RS256/384/512), RSA-PSS (PS256/384/512) and ECDSA (ES256/384/512) accept PKCS#8, PKCS#1 (BEGIN RSA PRIVATE KEY) or SEC1 (BEGIN EC PRIVATE KEY) private keys or a private JWK — or generate a test key pair in one click, with the public key as PEM and as a JWK carrying an RFC 7638 thumbprint kid, ready for a JWKS. Quick buttons add iat, nbf and exp (+15 minutes to +30 days) and fill in the iss, sub, aud and jti registered claims. The Verify tab checks a token against a secret, public key PEM, X.509 certificate or JWK/JWKS, validates exp, nbf and iat with a configurable clock leeway, can pin the expected algorithm, and always rejects alg: none. To simply inspect a token, use the JWT decoder on this site.

## How to use

1. Choose an algorithm, then enter an HMAC secret, paste a private key or generate a key pair
2. Edit the header and payload, using the quick buttons for iat, exp and other claims
3. Copy the signed JWT, or switch to Verify to check a token with a secret or public key

## Features

- HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512
- One-click RSA / EC key pairs with public PEM and a JWK with kid
- Accepts PKCS#8, PKCS#1 and SEC1 private keys and JWKs
- Verifies with public key PEM, X.509 certificates or JWK / JWKS
- exp / nbf / iat checks with clock leeway; rejects alg: none
- iat / exp presets and registered claims in one click
- Local WebCrypto — keys are never uploaded

## FAQ

### What is the difference between HS256 and RS256 / ES256?

HS256 is symmetric: the issuer and verifier share one secret, which suits a single service. RS256, PS256 and ES256 are asymmetric: tokens are signed with a private key and verified with a public key that can be published to other services or a JWKS, which suits multi-service and third-party verification. ES256 has shorter keys and signatures; PS256 uses the more modern RSA-PSS padding.

### How long should an HMAC secret be?

RFC 7518 requires the key to be at least as long as the hash output: 32 bytes (256 bits) for HS256, 48 bytes for HS384 and 64 bytes for HS512. The tool warns when a secret is too short. In production use a high-entropy random secret such as the one from the Random button, not a memorable password.

### Why does verification say the signature is invalid?

Common causes are a wrong key or wrong secret format (a Base64 secret treated as text), an algorithm mismatch such as an RSA public key for an ES token, a token truncated or padded with spaces when copied, or a modified header or payload. If the signature is valid but the token is expired or not yet valid, the exp and nbf problems are listed separately.

### Is it safe to create and sign JWTs in a web page?

Signing, verification and key generation all run locally through the browser’s WebCrypto API, and keys and tokens are never sent to a server. Even so, use it for development and test keys only, and never paste production private keys or long-lived tokens into any web page.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.