How to Generate a JWT with JSON Payload and HMAC-SHA256

What the JWT Generator does

JWT Generator creates a signed token from JSON payload text and a secret. It is useful when you need a token-shaped value for development, integration checks, or a controlled example. The tool uses HMAC with SHA-256 for the signing operation, while the algorithm input defaults to HS256 and is placed in the token header.

The payload is optional. Leaving it blank makes the tool use its built-in default payload, so you can try the generator without preparing JSON first. A secret is optional as well and defaults to my-secret when no value is supplied. For a custom token, enter your own JSON payload and secret instead.

How to generate a JWT

1. Open the JWT Generator and review the payload, secret, and algorithm inputs.

2. In the payload field, enter valid JSON if you want custom claims. For example, use {"sub":"user-123","role":"admin"}. If you leave the field blank, the tool uses its built-in default payload.

3. Enter a secret in the secret field. If you leave it blank, the tool uses my-secret. Do not place a secret beside ciphertext or share a real production secret in an example.

4. Leave the algorithm input at HS256 unless you need a different header label for your specific test. The signing operation remains HMAC with SHA-256; changing the algorithm value does not change that signing method.

5. Generate the token. If the payload is not blank, the tool first parses it as JSON. Invalid JSON produces an unsuccessful outcome rather than a generated token, so correct the payload and try again.

How to read the result

A successful result is a nonempty token with three sections separated by periods. This structure indicates that the generation call returned a token-shaped result; it does not by itself establish that the token is accepted by a particular service or that it provides a security guarantee.

The value in the header reflects the algorithm input, whose default label is HS256. The signing method used by the tool is HMAC with SHA-256. If the result is unsuccessful, check whether the payload field contains valid JSON and whether the input reflects the token you intended to create.

The runtime contract declares that the tool does not use network access. That declaration does not establish where the tool runs or how submitted values are handled, so avoid entering secrets that you should not use in this setting. For a related task, use a JWT Decoder when you need to inspect an existing token rather than generate a new one.

Worked example

A developer needs a token-shaped example for a test request and wants to include a subject and role in the JSON payload.

Enter {"sub":"user-123","role":"admin"} as the payload, enter demo-secret as the secret, leave the algorithm label at HS256, and generate the token.

A successful result has a nonempty token made of three sections separated by periods.

Limitations

• The runtime contract declares no network access, but that does not establish the deployment environment or how submitted payloads and secrets are handled.
• The algorithm input label does not change the underlying HMAC-SHA256 signing operation.

Common errors

• Cause: the payload is not valid JSON, such as a missing quotation mark or an extra comma. Correction: fix the JSON syntax, then generate the token again.

FAQ

Can I generate a token without entering a payload?

Yes, when the payload field is blank, the tool uses its built-in default payload. When the field is not blank, it parses the text as JSON, so custom input must be valid JSON.

What happens if I leave the secret blank?

No special secret is required when the field is blank because the tool defaults to my-secret. Use a different secret for your own test scenario, and do not place a secret beside ciphertext.

What should a successful result look like?

A successful call returns a nonempty token containing three dot-separated sections. Invalid payload JSON instead produces an unsuccessful outcome.