Generate JWT RS256

Sign JWT claims with an RSA SHA-256 key.

freeworks offlinenothing uploaded
ToolJWT RS256 Generator
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The header and payload are serialized as JSON, encoded with Base64url, joined with a period, and signed with RSA PKCS#1 v1.5 using SHA-256. The signature covers the exact encoded bytes, not a reserialized semantic object.

  • RS256 is the JOSE identifier for RSA-SHA256 signatures.

Worked example

Generate RS256 JWT with admin claims
Create an RSA-signed JWT with auto-generated 2048-bit key pair, 1-hour expiry
Input
											Payload: {"sub":"user-12345","name":"Jane Smith","role":"admin"}
Expires in minutes: 60
Output
												Token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMzQ1IiwibmFtZSI6IkphbmUgU21pdGgiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3ODc2NjE5MTUsImV4cCI6MTc4NzY2NTUxNX0.aOluymRQbb_GEBrJdTyadH_M1PnlaUDtaXJfSc42kz5MJI18IIdhu3dBS93WhF5WqZNdISFranlDydhasR7D5BGkF82uAFTZF0nFGJxpCp8Ygi42WTwJEppYREjSQIZWjuMHti5vTrrVQC86hlc05YLAcWkfEz0a8MVBnD-jHWOnC4kLFOMesERn_pEmYedz7v0WpGltRjlY5coX83wdlAq7tdEyDwUTnOV3YFbS3_gJ-C9GgjsDg1Wox5Ot3o17J8S8KoGUegpQcWDBrqgXskVjhjmQs0rvXWSBs16DwkL8RfCm7PJiYiheCjCUs7tIC-bI_tIUHn7i5SHF1sDyLg
Public key PEM: -----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv3FKLL17hmwbgBQm93o8
w2vmoV3Qe224cWNxYG6xfyowPB6txMs+rAosuXoE11fEO/yQRbuTx2WGGTgl9R+k
c7ywYOJbKBNorj+CeOsC…

When to use this

Identity providers, integration fixtures, and downstream API credentials sign RS256 tokens.

Edge cases

  • Changing JSON whitespace changes the signed bytes.
  • A token signed with another RSA key fails verification.
  • An expired claim can be correctly signed and still unusable.

References