JWT Generator

Create and sign JSON Web Tokens with HMAC algorithms, standard claims, custom payloads, and client-side signing.

JWT Generator

Create and sign JSON Web Tokens

{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "iat": 1792689805
}

Your secret never leaves your browser. All signing is done client-side using the Web Crypto API.

🔐

Fill in the fields above and click "Generate" to create a JWT

What is a JWT Generator?

A JWT generator is a tool that creates and signs JSON Web Tokens (JWTs): the industry-standard format for securely transmitting claims between parties. JWTs are widely used for authentication, authorization, and API security. Each token consists of three parts: a header (algorithm and type), a payload (claims like user ID, issuer, and expiration), and a signature that verifies the token has not been tampered with.

CodeHelper's JWT Generator lets you build tokens visually with standard and custom claims, sign them with HMAC algorithms (HS256, HS384, HS512), and copy the result: all entirely in your browser using the Web Crypto API. Your secret key never leaves your machine.

Key Features

  • HMAC Signing: Sign tokens with HS256, HS384, or HS512 algorithms using the Web Crypto API.
  • Standard Claims: Set subject (sub), issuer (iss), audience (aud), expiration (exp), issued at (iat), and not before (nbf).
  • Expiration Presets: Quick presets for 1 hour, 6 hours, 24 hours, 7 days, 30 days, or 1 year.
  • Custom Claims: Add any JSON payload as custom claims (e.g., role, permissions, name).
  • Color-Coded Output: Header, payload, and signature are color-coded for easy visual inspection.

How to use the JWT Generator

  1. Select the signing algorithm (HS256, HS384, or HS512).
  2. Fill in standard claims: subject, issuer, audience, and expiration.
  3. Add custom claims as JSON if needed.
  4. Enter your secret key for signing.
  5. Click Generate to create the signed JWT.
  6. Copy the token for use in your application or API testing.

Whether you are testing API authentication, generating tokens for development, or learning how JWTs work, this free JWT generator creates properly signed tokens instantly with complete privacy.

Frequently Asked Questions

How is a JWT signed with HS256?

The header and payload are serialized to JSON, Base64URL encoded and joined with a dot. That string is signed with HMAC-SHA256 using your secret, and the Base64URL signature becomes the third part. This page does exactly that with the Web Crypto API, so the token verifies anywhere the same secret is known.

How long should the secret be?

At least as long as the hash output: 32 bytes for HS256, 48 for HS384, 64 for HS512. Short human passwords can be brute forced offline from a single token. The Generate random secret button gives you 32 random bytes as Base64URL; store it in an environment variable, never in the client.

What is the difference between exp, iat and nbf?

iat is the issue time, exp is the moment after which the token must be rejected, nbf is the moment before which it must be rejected. All three are Unix timestamps in seconds, computed from your clock when you click Generate. The expiration presets set exp relative to now.

Can I generate RS256 tokens here?

Not yet. RS256 and ES256 need an RSA or EC private key; this generator covers the HMAC family (HS256, HS384, HS512), which is what most single service APIs and test setups use. Use openssl or your auth library for asymmetric tokens, then paste the result in the JWT Decoder to inspect it.

Related

toolBase64 Encoder/DecoderEncode and decode Base64 strings, files, images with data URL support. Upload files or paste text for instant conversion.toolJWT Decoder & ValidatorDecode, validate, and inspect JSON Web Tokens (JWT). Parse header, payload, verify signatures with HMAC algorithms, and check token expiration: all client-side.apiAnti-Malware APIsSecurity and malware detection APIsapiAuthentication APIsAuthentication and authorization services

Free forever, no ads, no tracking. Support the project