Build a JSON Web Token from a JSON payload and a secret. HS256 signing uses your browser's native Web Crypto (requires HTTPS). For the none algorithm the token is unsigned — never use it in production. Everything runs locally.
Two options: HS256 (HMAC-SHA256), which signs with the secret you type using your browser's native Web Crypto, and none, which produces an unsigned token ending in a trailing dot. The none option is for local testing only and must never be used in production.
Web Crypto is only available in a secure context, so the page must be served over HTTPS or from localhost. HS256 also requires a non-empty secret; if either is missing, generation stops with an error message.
No. Signing runs locally through your browser's Web Crypto API and the secret is never sent to a server or written to storage. Clearing the form or reloading the page discards it.