JWT Generator - Create JSON Web Tokens Online

Generate JWT tokens with custom claims and expiration. Sign with HS256/HS384/HS512 algorithms. Test authentication flows. Free and private.

Header

Algorithm

Secret Key

Show secret

Expiration

Token Expires In

Issued At (iat): -

Expires At (exp): -

Payload (Claims)

Subject (sub)

Issuer (iss)

Audience (aud)

JWT ID (jti)

Custom Claims (JSON)

Generated Token

Click Generate to create a JWT

Copied!

SAML Decoder - Decode SAML Assertions & …

View all Jwt decoders →

Frequently Asked Questions

Enter your payload claims, set expiration time, and provide a secret key. The generator creates a properly signed token using HMAC algorithms. The token includes header, payload, and cryptographic signature.

HMAC-based algorithms: HS256 (most common), HS384, and HS512. Asymmetric algorithms (RS256, ES256) require server-side signing with private keys and aren't suitable for browser-based generation.

JWT generation encodes the payload in Base64-URL format - readable by anyone. The signature verifies integrity, not confidentiality. If you need secrecy, encrypt sensitive claims before adding them to the JWT.

Standard claims: sub (subject/user ID), exp (expiration), iat (issued at), iss (issuer), aud (audience), jti (unique token ID). Add custom claims for roles, permissions, or app-specific data.

Short-lived tokens (15 minutes to 1 hour) are more secure. Long-lived tokens risk compromise. Use refresh tokens for extended sessions. Balance security with user experience - frequent re-authentication annoys users.

Use at least 256 bits (32 characters) of random data. For HS256, use a cryptographically random string. Never use passwords or predictable strings. Generate secrets with crypto.getRandomValues() or equivalent.

Only for testing and development. Production JWTs should be generated server-side with secure key management. Never expose production secrets in browsers or client-side code.

JWTs carry claims (user info, roles) and expire automatically. API keys are long-lived identifiers requiring database lookup. JWTs are stateless; API keys are stateful.

No! JWT payloads are readable by anyone with the token. Never include passwords, credit cards, or sensitive personal data. Include only what's needed for authorization decisions.

Yes. All generation happens in your browser using the Web Crypto API. Your secret key never leaves your device. However, never share production secrets or paste them into any online tool.

Related Tools