Advertisement
Guide
About the JWT Builder
This tool builds and signs a JSON Web Token from a payload you define. You choose the claims — subject, expiry, custom fields — pick an HMAC algorithm (HS256, HS384, or HS512), supply a secret, and it produces a complete, signed token ready to drop into an Authorization: Bearer header. It's the counterpart to the JWT Decoder: build here, inspect there.
Signing happens in your browser with the Web Crypto API, so your secret and payload never reach a server. That makes it safe for experimenting, building test fixtures, and understanding exactly how a token is assembled.
How a signed JWT is assembled
The header and payload are each serialized to JSON and Base64URL-encoded, then joined with a dot. That string is signed with your secret using the chosen HMAC algorithm, and the Base64URL signature is appended as the third segment. The result is header.payload.signature. Anyone can read the first two parts, but only someone with the secret can produce a matching signature — which is what makes the token trustworthy.
Choosing an expiry
Set the exp claim to a sensible lifetime — minutes to hours for access tokens, longer for refresh tokens. Short-lived tokens limit the damage if one leaks. Keep your signing secret long and random (a generated passphrase works well), because the security of every token you issue rests on it staying secret.
How to use it
- 1Edit the payload with your claims (sub, custom fields, and so on).
- 2Set an expiration so the token is not valid forever.
- 3Choose the algorithm (HS256 is the common default) and enter your secret.
- 4Copy the signed token and verify it in the JWT Decoder.
Frequently asked questions
What is the difference between the JWT Builder and Decoder?
The Builder creates and signs a new token from a payload and secret. The Decoder reads an existing token's header and payload. Use them together to build and then inspect tokens.
Which algorithm should I choose?
HS256 (HMAC-SHA256) is the most widely used and a safe default. HS384 and HS512 use longer hashes; pick whichever your backend expects.
Can I create RS256 (asymmetric) tokens here?
This tool signs with HMAC (HS256/384/512), which uses a shared secret. RS256 requires an RSA private key and is typically handled server-side.
Is my secret sent anywhere?
No. Signing is performed locally with the Web Crypto API. The payload and secret never leave your browser.
Should I use tokens generated here in production?
This is great for testing and learning. For production, generate and sign tokens on your server with a securely stored secret, never in client-side code shipped to users.