About the JWT Generator
A JSON Web Token is three Base64URL parts joined by dots: a header, a payload and a signature. This generator builds all three for you. Write the payload as JSON, choose HS256, HS384 or HS512, type a secret and the signed token appears instantly. One button adds an issued-at time and a one-hour expiry, and you can add extra header fields such as a key id. The token is signed with HMAC using the Web Crypto API inside your browser, so your payload and secret are never sent anywhere. It is made for testing APIs, learning how JWTs work and creating fixtures. Use test secrets only.
Updated October 2026
How to use the JWT Generator
- 1Choose the signing algorithm: HS256, HS384 or HS512.
- 2Write or edit the payload as a JSON object.
- 3Press Add iat and 1 hour expiry if you want time claims.
- 4Type the secret that your server uses to verify tokens.
- 5Copy the token and send it in an Authorization: Bearer header.
How the token is built
The header says which algorithm signed the token, usually {"alg":"HS256","typ":"JWT"}. The payload holds the claims, such as who the token is about, when it was issued and when it expires. Each part is JSON turned into Base64URL text, which uses dashes and underscores so it can sit inside a URL.
The two parts are joined with a dot and signed with HMAC using your secret. The signature is added as the third part. Change one character in the payload and the signature stops matching, which is how a server notices tampering.
Common claims
- sub: the subject, usually a user id.
- iat: when the token was issued, in seconds.
- exp: when it stops being valid.
- nbf: the earliest time it can be used.
- iss and aud: who issued it and who it is for.
- Custom claims such as role or plan, kept small.
Testing tips and related tools
Decode any token you receive with the JWT Decoder to check the claims and the times. To produce the raw signature bytes for a message, use the HMAC Generator, and for a plain checksum use the Hash Generator. If your payload is large, tidy it first with the JSON Formatter so you can see mistakes before signing. Always send tokens over HTTPS and keep expiry times short.
Features
- HS256, HS384 and HS512 signing
- Live token as you type
- One-click iat and exp claims
- Optional extra header fields
- Coloured header, payload and signature parts
- Clear messages for invalid JSON
- Runs in your browser with Web Crypto
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe string used to carry claims between two parties, often as proof of login. It has a header, a payload and a signature, separated by dots.
What does the signature do?
It lets the server check that the header and payload were not changed. It is made by running HMAC over header.payload with the secret key.
Is the payload encrypted?
No. Anyone can decode the first two parts, so never put passwords or private data in the payload. The signature only protects against tampering.
Which algorithm should I pick?
HS256 is the usual choice. HS384 and HS512 use longer signatures and the same kind of shared secret. Use RS256 or ES256 for public-key signing, which this tool does not do.
What are iat and exp?
iat is the time the token was issued and exp is when it expires, both in seconds since 1970. Servers should reject a token after exp.
How long should my secret be?
At least as long as the hash output, so 32 characters or more for HS256, and random. Short or guessable secrets can be cracked offline.
Is it safe to paste my real secret?
The calculation is local, but you should still use test keys on any website. Keep production secrets in your server settings.