Home › Generators & Text Tools › JWT Generator
JWT Generator
This JWT generator signs a JSON Web Token in your browser. Edit the header and payload, type a secret, pick HS256, HS384, or HS512, and get a signed token instantly. The signing uses the WebCrypto API, so your secret never leaves your device — nothing is sent to any server. Use it to learn how JWTs work, to test an API, or to build example tokens.
Already have a token to read? Try the JWT decoder. Never put passwords or real secrets in a payload — anyone who gets the token can read it.
Anatomy of a JWT
A JWT is three Base64URL parts joined by dots. The header and payload are readable by anyone; only the signature is secret, and it is made from the first two parts plus your key.
How it works
A JSON Web Token is a compact, signed package of information. It has three parts, separated by dots: header, payload, and signature. The header is a small JSON object that names the signing algorithm, usually {"alg":"HS256","typ":"JWT"}. The payload is a JSON object of claims — facts about the token, such as the user id in "sub", the name, and "iat", the time the token was issued. The signature is made by signing the first two parts with a secret key, so anyone holding the key can check that the token was not changed after it was made.
Each part is encoded with Base64URL, a version of Base64 that is safe to put in a web address: it uses "-" and "_" instead of "+" and "/", and drops the "=" padding. The token is then header + "." + payload + "." + signature. The header and payload are only encoded, not encrypted, so anyone who receives a token can decode and read them. That is why you must never put a password or a secret in the payload — put only facts you are happy to share with the token holder.
The signing step uses HMAC, a way of combining a secret key with a message using a hash function. HS256 pairs HMAC with SHA-256, HS384 with SHA-384, and HS512 with SHA-512. The same header, payload, and secret always give the same signature, so a server checks a token by signing the first two parts again with its own copy of the secret and comparing the result. If even one character of the header or payload was changed, the signature will not match, and the server knows the token was tampered with.
This generator signs with the WebCrypto API built into your browser, which is the same standard library that secure websites use. Your secret is passed to the signing function and never leaves the page. Change the algorithm and the header's "alg" field updates to match, so the header always describes the signature honestly. A common use is testing: build a token with a known user id and expiry, then send it to your API and watch how the server reacts. For learning, the default values reproduce the classic example from the JWT standard itself — see the worked example below.
Worked example
Build the classic example token from the JWT standard. Use the header {"alg":"HS256","typ":"JWT"}, the payload {"sub":"1234567890","name":"John Doe","iat":1516239022}, and the secret "your-256-bit-secret".
Step 1: Encode the header as Base64URL. It becomes eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
Step 2: Encode the payload as Base64URL. It becomes eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
Step 3: Join the two parts with a dot, and sign the result with HMAC-SHA-256 using the secret "your-256-bit-secret". The signature is SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c.
Step 4: Join all three parts with dots to form the token.
Try it yourself: the tool opens with exactly these values. Press Generate JWT and the tool gives exactly the same token — eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c — the standard example token, 155 characters long.
FAQ
What is a JWT?
A JWT, or JSON Web Token, is a compact way to send signed information between two parties, usually a server and a browser or app. It has three parts separated by dots: a header that names the signing algorithm, a payload that carries the claims such as the user id, and a signature that proves the token was not changed. Because the signature is made with a secret key, anyone who has the key can check that the token is genuine.
Is my secret safe with this tool?
Yes. The token is signed in your browser with the WebCrypto API, and your secret is never sent to any server or stored anywhere. That said, never sign a token with a real production secret on a shared or public computer, and never paste a real secret into any website you do not fully trust. For learning and testing, use a throwaway secret like the default one shown here.
What is the difference between HS256, HS384 and HS512?
They are three strengths of the same HMAC-SHA signing method. HS256 uses SHA-256 and makes a 256-bit signature, HS384 uses SHA-384, and HS512 uses SHA-512 for a longer signature. HS256 is the most widely used and is fine for most cases. HS512 gives a longer signature for extra safety margin, at the cost of a slightly longer token. All three use the same secret.
What goes in the payload?
The payload is a JSON object of claims about the token. Common ones are sub for the subject or user id, name for the user's name, iat for the time the token was issued, exp for the time it expires, and iss for the issuer. Keep the payload small and never put passwords or other secrets in it, because anyone who receives the token can read the payload by decoding it.
How do I check a token this tool made?
Use the JWT decoder on this site to read the header and payload of any token. To check the signature, sign the same header and payload again with the same secret and algorithm: if the token matches, the signature is valid. If even one character of the header or payload changes, the signature no longer matches, which is how a server spots a tampered token.