JWT sign
Sign a JSON payload into a JWT with HS256/384/512 (HMAC secret) or RS256/ES256 (PEM PKCS8 private key). WebCrypto only, runs on your device.
JWT sign assembles the standard header.payload.signature string from a JSON payload under one of five algorithms. HS256, HS384 or HS512 sign over a typed secret; RS256 or ES256 sign over a PEM key. Signing calls crypto.subtle directly, so no outside JWT library touches the token. A missing secret, key or invalid payload is refused before signing.
Questions
What algorithms are supported?
HS256, HS384 and HS512 using a typed HMAC secret, plus RS256 and ES256 using a PEM PKCS8 private key.
What does the payload field take?
Any JSON object; invalid JSON is refused with the parser's own error message.
What signs the token?
WebCrypto's crypto.subtle directly, with no third-party JWT library involved.
What happens if I pick RS256 without a key?
The tool refuses with "RS256 needs a PEM PKCS8 private key".
Does it verify tokens too?
No, this tool only signs; verification is a separate concern this tool does not perform.
Compare
| Tool | Runs on the CLI | Live as you type |
|---|---|---|
| JWT sign | Yes | Yes |
| JWT decode / verify | Yes | Yes |
| UUID v4 generator | Yes | No |
| ULID generator | Yes | No |
| NanoID generator | Yes | No |
| Mock / random data generator | Yes | No |
| UUID / ULID inspector | Yes | Yes |