JWT RS256 Generator

Sign test JWTs in your browser without uploading the private key and keep production key-handling responsibility explicit.

Generate an RS256 JWT locally

Use a PKCS#8 PRIVATE KEY PEM. The header algorithm is forced to RS256 so the tool cannot silently sign one algorithm while labeling another.

Header JSON

{"typ":"JWT"}

Payload JSON

{"sub":"123","name":"Alex","exp":4102444800}

PKCS#8 private key PEM

Generated tokenMatching public key (shown for generated demo keys)

Private-key operations run in this browser. Protect production signing keys according to your real application's key-management policy; an online utility is not an HSM or production signing service.

Trust and standards boundaries

Formatting is not schema validation, Base64 is not encryption, URL normalization is not a privacy guarantee, UUID metadata is not provenance, and decoded JWT claims are not trusted until cryptographic and application-specific validation succeeds. RS256 tools accept explicit PEM key formats and do not fetch issuer keys or make authorization decisions.