What is a JWT and what are its three parts?

A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three dot-separated, Base64URL-encoded segments: a header naming the algorithm, a payload holding the actual claims, and a signature that proves the header and payload were not altered after signing.

Is HS256 secure enough for production use?

HS256 (HMAC-SHA256) is cryptographically strong when paired with a long, high-entropy secret — at least 256 bits of real randomness, not a short guessable phrase. Its main constraint is architectural, not cryptographic: since the same secret signs and verifies, every party that needs to verify tokens must be trusted with the ability to also create valid ones.

Does this tool support RS256 or other asymmetric algorithms?

No — this tool generates HS256 (symmetric, HMAC-based) tokens only. RS256 and ES256 use a private/public key pair instead of a shared secret and require key-pair generation and a different signing flow; for those, use a server-side library such as jsonwebtoken or jose.

What are the standard registered JWT claims?

RFC 7519 defines several optional standard claims: sub (subject/user ID), iss (issuer), aud (audience), exp (expiration time, Unix seconds), iat (issued-at time), nbf (not valid before), and jti (a unique token ID). None are required by the spec itself, but exp and sub are used almost universally in real systems.

No — by default a JWT is signed, not encrypted. The header and payload are only Base64URL-encoded, which is trivially reversible by anyone, so never put secrets or sensitive personal data directly in the payload. The signature only proves the content has not been tampered with; it does not hide it.

Why does the payload need an exp (expiration) claim?

Without an expiration, a JWT remains valid forever once issued, which is a serious risk if a token is ever leaked or intercepted. Setting exp to a Unix timestamp a short time in the future (an hour is common for access tokens) limits the damage window of a compromised token and is treated as a near-mandatory security practice.

Can I generate a token that never expires by omitting exp?

Yes, technically — most JWT libraries only reject an expired token if exp is present and in the past; omitting it entirely means no expiration check happens on the verifying side. This is almost never appropriate for anything beyond quick local testing, since a leaked non-expiring token stays valid indefinitely.

Will this generated token actually be accepted by my API?

Yes, as long as your API verifies HS256 tokens using the exact same secret string you entered here. The signature this tool computes uses the standard Web Crypto HMAC-SHA256 primitive, so it is byte-for-byte the same output any correct HS256 implementation would produce for the same header, payload, and secret.

Is it safe to type a real production secret key into this tool?

The signing itself happens entirely client-side via SubtleCrypto and nothing is sent to a server, but as a general practice, avoid pasting real production signing secrets into any web tool — generate a throwaway test secret for experimentation and keep production secrets confined to your actual backend's environment configuration.

Why is my payload rejected with an "Invalid JSON payload" error?

The payload field must be valid, parseable JSON — a JavaScript object literal with single-quoted keys, trailing commas, or unquoted keys will fail. Check that all keys and string values use double quotes and that there are no trailing commas before a closing brace.

JWT Generator — Generate JSON Web Tokens Online Free

FREE

Loading…

Go Pro ↑

Algorithm

HS256 (HMAC-SHA256)

Payload (JSON)

Secret Key

Related Tools

Binary To Decimal

Convert between binary, decimal, hex and octal number systems

Color Converter

Convert colors between HEX, RGB, and HSL formats

Convert Binary

Convert binary numbers to text and text to binary

Convert Timestamp

Convert Unix epoch timestamp to standard date format and back

Count Words

Count words, characters, sentences and paragraphs in text

Convert Datetime

Convert datetime between different formats and timezones

Your files never leave your device. All processing happens locally in your browser — nothing is uploaded to our servers.Files are never stored on our servers · No tracking of your file contentsPrivacy Policy

What is Generate JWT Token?

Generate JWT Token builds a real, verifiable HS256-signed JSON Web Token from any JSON payload and secret key you provide, computing the signature with the browser's native Web Crypto API rather than a hand-rolled or simulated HMAC implementation.

A JWT is three Base64URL-encoded segments joined by dots: a header naming the algorithm and token type, a payload carrying arbitrary claims about the subject, and a signature that proves the first two segments have not been tampered with since they were signed. This structure is what makes JWTs so common for stateless authentication — a server can verify a token's signature using only the shared secret (or a public key, for asymmetric algorithms) without needing to look anything up in a session store, which is exactly why they are the default choice for API auth, single sign-on, and microservice-to-microservice trust.

HS256, which this tool implements, is a symmetric algorithm: the same secret key both signs and verifies the token, meaning every party that needs to check a token's validity must hold that same secret. That is fine inside a single backend or a small trusted cluster, but it means anyone with the secret can also mint new, valid tokens — so HS256 is the wrong choice whenever a third party needs to verify tokens without being trusted to issue them. That is exactly the scenario asymmetric algorithms like RS256 or ES256 solve: a private key signs, and a widely distributed public key verifies, so a token issuer never has to hand out signing power to every consumer. This tool intentionally covers HS256 only, since it is by far the most common case for internal APIs, local development, and testing, and it needs nothing more than a single shared string to work end to end in a browser.

Because the entire signing operation runs through SubtleCrypto locally, the secret key you type never leaves your machine — useful for generating throwaway test tokens without ever putting a real production signing key into a form on the internet. That said, a token generated here is a genuine, fully valid JWT: any API expecting HS256 tokens signed with the secret you provide will accept it exactly as it would one minted by your real backend.

Once you have a token, Verify & Decode JWT confirms its signature and inspects the claims inside it.

How It Works

The tool builds the standard JWT header {"alg":"HS256","typ":"JWT"}, Base64URL-encodes it, parses your payload JSON and Base64URL-encodes that as well, then joins the two with a dot to form the signing input. That signing input is passed to crypto.subtle.importKey() to register your secret as an HMAC-SHA256 key, followed by crypto.subtle.sign(), which computes the actual signature using the Web Crypto API's native, browser-audited implementation — the same primitive used for TLS and other security-sensitive operations, not a custom JavaScript reimplementation of HMAC. The resulting signature bytes are Base64URL-encoded and appended as the third segment, producing a complete header.payload.signature token. Nothing is transmitted anywhere; the secret, payload, and resulting token all stay inside your browser tab.

How to Use

Enter the payload

Edit the pre-filled JSON payload or replace it entirely with your own claims — sub, iat, and exp are included by default, and you can add any custom fields your API expects.

Set the secret key

Type the HMAC secret your API will use to verify the token. Use a long, random value for anything beyond quick local testing — the same secret must be configured on the verifying side.

Generate the token

Click "Generate JWT". The header is built automatically, your payload is validated as JSON, and the signature is computed instantly via the Web Crypto API — HS256 is the only algorithm this tool signs with.

Inspect the three segments

The color-coded output separates header, payload, and signature so you can visually confirm the structure before using the token — useful for spotting a payload typo before it reaches your API.

Copy and use the token

Copy the complete JWT into an Authorization: Bearer header, a Postman or Insomnia environment variable, or a test fixture for your authentication middleware.

Who Uses This Tool

🔐

API Authentication Testing

Generate test JWT tokens for local development and staging environments without needing a running auth server.

🧪

Unit Test Fixtures

Create signed tokens with custom claims to use as fixtures in automated tests for your middleware.

📚

JWT Learning

Experiment with different payload claims and secrets to understand how JWT structure and signing works.

🛠️

Postman / Insomnia Setup

Quickly generate a token with the correct claims to paste into API client Authorization headers.

⚙️

Microservice Simulation

Simulate tokens from different services by changing the iss, sub, and aud claims to test authorization logic.

⏰

Expiry Testing

Create tokens with specific exp timestamps to test token refresh flows and expiry-handling code paths.

Why Choose This Tool

Web Crypto API Signing

Uses SubtleCrypto HMAC-SHA256 for signing, the same standard used by production JWT libraries.

Color-Coded Token Parts

Header, payload, and signature are displayed in distinct colors so you can visually identify each section.

Pre-Filled Payload

A sensible default payload with sub, name, iat, and exp claims is provided so you can generate a token in one click.

Standards Compliant

Output follows RFC 7519 exactly — Base64URL encoding, dot-separated parts, and correct HS256 algorithm header.

No Server Required

Token generation is 100% client-side so your secret key is never exposed to any external server.

Instant Copy

Copy the complete JWT token to your clipboard with a single click for immediate use in requests.

Key Benefits

Generates standards-compliant, RFC 7519 HS256 JWT tokens

Signs using the browser's native Web Crypto API — not a hand-rolled HMAC

Color-coded token parts: header, payload, signature

Pre-filled payload with common claims (sub, name, iat, exp) to get started instantly

Accepts any custom JSON payload and claim structure

Secret key and payload never leave your browser

Frequently Asked Questions

Free Online Document Tools for Everyone

iLoveDocsTools is used by students, professionals, and businesses across the United States, Canada, United Kingdom, Australia, India, and more than 100 other countries. All tools are browser-based and process files privately — your files never leave your device. Free to use, with Pro plans for unlimited access.

Generate JWT Token