JWT Generator
Build and sign a JSON Web Token with HS256, HS384 or HS512, setting the standard claims and any custom ones you need.
Set to 0 to leave out the expiry.
A JSON object. These are merged over the standard claims.
Files are processed in your browser and are never uploaded to a server.
How to use
Free to use with no sign-up, no install and no usage limit.
Fill in the claims, set a secret, and a signed token appears. The three parts are shown decoded underneath, so you can see exactly what went in.
The companion to the JWT decoder: that one opens tokens you received, this one makes tokens to send. Testing an API or checking that expiry is handled usually means producing a token by hand, which otherwise costs a script or a running server.
Times are in seconds, not milliseconds. Passing Date.now() straight into exp puts the expiry around the year 50,000, which no verifier will accept — a mistake common enough to be worth naming.
A JWT is signed, not hidden. The payload is only base64, so anyone holding the token can read every claim in it. Passwords, national ID numbers and card details do not belong in there, and a warning appears if a claim name looks like one of those.
The secret should be at least as long as the hash output — 32 bytes for HS256. A short secret can be brute-forced offline from a single captured token, and then anyone can mint tokens your server will trust.
Custom claims are merged over the standard ones, so a field you write yourself wins if the names collide.
Nothing is sent to a server. The token is built and signed inside your browser.