How to sign a JSON Web Token with HMAC

1. Enter the payload JSON

   "Payload (JSON)" is the claims object — `{ "sub": "user-123", "role": "admin", "exp": 1748908800 }`. Standard claims like `iat` (issued at), `exp` (expiry, Unix seconds), `iss`, `aud` are conventions, not enforced — you set them yourself.

2. Enter the secret

   "Secret" is the HMAC shared secret. Keep this on the server only — clients should NEVER see the secret used to sign tokens. Length matters: for HS256 use at least 256 bits (32 random bytes) of entropy.

3. Pick the algorithm

   "Algorithm" defaults to `HS256` (HMAC-SHA-256). HS384/HS512 trade compute for output size. For asymmetric (RS256/ES256) you'd need a private key — this tool only signs with HMAC; for asymmetric, generate the token in your backend with a real JWT library.

4. Press Run

   Result returns a single `token` — the encoded `header.payload.signature` string. Decode it back with jwt-decoder to confirm the payload survived the round-trip. Treat the secret as you would a database password: rotate periodically.