What's the difference between Personal and Studio?

Personal ($39) is for one person — unlimited use on one active device at a time. Activate on a new device and the old one signs out. Studio ($199) is for teams and commercial client work — unlimited team members, early access to new tools, and a commercial license.

Do I need an account?

No. Use any tool free up to 5 times per day on compute-heavier tools, and unlimited on lightweight ones. No card, no account, no signup required.

Where are my files processed?

Right on your device. Files never upload to any server. Everything runs in your browser — you can verify in DevTools → Network.

What happens if I use my Personal license on a second device?

The new device activates and the old device signs out. Your license key stays the same — you just move it between devices as needed. No limit on how often you switch.

Does this work on my phone?

Yes. Every tool works on iPhone, Android, tablet, and desktop.

What if I want a refund?

30-day money-back guarantee on both tiers. No questions asked. Email sales@cipherforces.com.

Will you add more tools?

Yes. New tools ship regularly. Your license includes every tool we ever release — Studio members get early access.

SecurityFreeBy Daniel BeglaryanUpdated August 2026

Generate a JWT

Build and sign a JSON Web Token for testing — right in your browser.

PrivateWorks OfflineNo Account

These are test tokens

The token is built and signed entirely in your browser — no key, secret, or claim ever leaves your device. Use it for local development and testing only. As a rule, never paste a real production signing secret or private key into any web page, including this one, on a machine you don’t fully trust.

Header

alg tracks the picker

Payload

Add a claim

Algorithm

Signing with HS256 — HMAC · shared secret.

Secret

Show secretSecret is base64url-encoded

Deep dive

About Generate a JWT.

Build and Sign a JSON Web Token in Your Browser

Edit the header and payload as plain JSON, pick a signing algorithm, provide a secret or key, and get a ready-to-use token. The JWT Generator supports HMAC (HS256/384/512) with a shared secret, and RSA and elliptic-curve signatures (RS, PS, and ES at 256/384/512) with a pasted PKCS#8 private key — or generate a throwaway test key pair with one click. One-tap helpers add the common registered claims (iat, exp, nbf, sub, iss, aud, jti) so you do not have to remember the epoch math.

Everything — the claims, the secret, the private key, and the signing itself — happens locally in your browser using the Web Crypto API. Nothing is uploaded, logged, or sent to a server, which is exactly what you want when a signing key is involved. Many online JWT tools sign on their backend and see whatever key you paste; this one never does.

These are test tokens. The tool is for development, debugging, and learning — not for minting production credentials. Treat any secret or key you paste here the way you would anywhere: only on a machine you trust, and never a live production signing key.

Common Use Cases

API testing: Mint a token with a specific subject or scope claim to exercise an authenticated endpoint from Postman, curl, or your test suite.
Debugging auth flows: Set an expiry (exp) in the past or a not-before (nbf) in the future and watch how your middleware handles an expired or premature token.
Learning how JWTs work: Switch the algorithm or edit a claim and see the three-part token, plus its decoded header and payload, update instantly.
Local key pairs: Generate an ES256 or RS256 key pair, sign with the private key, then verify with the printed public key in your own service.
Test fixtures: Produce consistent tokens for integration tests without standing up a real identity provider.

Privacy: The JWT Generator runs entirely in your browser. Your header, payload, secret, and private key never leave your device — no upload, no network request, no storage.

Three steps