JWT Generator

100% free · Runs 100% in your browser · No signup needed

Security notice: this is a development/testing tool. Your secret is processed only inside this page and never leaves your browser — but never paste a production secret or a real user's token here. Use a proper backend for real authentication.

Header (JSON)

Payload (JSON)

Algorithm

Secret

Encoded token

— generate or decode a token —

HEADER

—

PAYLOAD

—

SIGNATURE

—

Acerca de JWT Generator

What is a JWT Generator?

A JSON Web Token (JWT) is the compact, URL-safe credential behind most modern authentication: a server signs a small JSON payload, the client sends the token with each request, and the server verifies the signature instead of re-checking a password. Our free JWT Generator is a developer workbench for those tokens — create signed tokens, inspect unknown ones, and verify signatures, all without leaving the page.

The tool has two modes. Encode mode takes a header JSON and a payload JSON (or builds the payload from a simple claim builder) plus your secret, and produces a signed token using real HMAC cryptography via the browser's WebCrypto API — with HMAC-SHA1, SHA-256, SHA-384, and SHA-512 all supported. The header comes pre-filled with {"alg":"HS256","typ":"JWT"}, the most common configuration in the wild, so you can generate your first token in seconds.

Decode mode takes any token you paste and splits it into its three color-coded parts — header, payload, and signature — with each JSON section pretty-printed for easy reading. Paste the matching secret and the tool re-computes the signature to tell you whether the token is genuinely signed by that secret, which is exactly how you debug "invalid signature" errors during development.

One warning is prominent in the tool and worth repeating here: this is a demo and development aid, not a production system — never paste production secrets or real user tokens into it. Everything runs locally in your browser and nothing is transmitted, which makes it perfect for learning and debugging, but production credentials should never leave your own infrastructure, no matter how trustworthy a page looks.

If you have used “sign in with” buttons or called an API with a Bearer token, you have already used JWTs — OAuth2 and OpenID Connect, the standards behind most modern login flows, issue access tokens in exactly this format. That is why being able to generate and inspect them by hand is such a practical skill: when your frontend sends a token and the API rejects it, the answer is almost always visible in the decoded payload or the signature check, not buried in framework logs.

Understanding a token’s anatomy helps everything else click. A JWT is three Base64URL-encoded segments joined by dots: the header (algorithm and token type), the payload (the "claims" — subject, expiry, issuer, and your custom data), and the signature (the HMAC of the first two segments under your secret). Anyone can read the payload — it is only encoded, not encrypted — which is why secrets and sensitive data never belong inside one.

How to Use the JWT Generator

To generate a token:

Keep or edit the pre-filled header JSON ({"alg":"HS256","typ":"JWT"}).
Enter your payload claims as JSON, or use the claim builder for common fields like sub, exp, and iat.
Choose the HMAC algorithm (HS256 is the standard default) and enter a secret — a dev-only test secret.
Click "Generate" — your signed token appears, ready to copy.

To decode and verify:

Paste any token into the decode panel.
Read the color-coded header and payload sections.
Enter the secret the token was signed with to verify the signature.

Key Features

Real HMAC signing: WebCrypto-powered HMAC-SHA1/256/384/512 — genuine signatures, not mock output.
Encode and decode modes: generate tokens and inspect unknown ones in one workbench.
Claim builder: construct payloads from common fields without hand-writing JSON.
Color-coded token view: header, payload, and signature visually separated and pretty-printed.
Signature verification: re-computes the signature against your secret to confirm authenticity.
Pre-filled standard header: {"alg":"HS256","typ":"JWT"} ready to go.
One-click copy: grab the token for your API client or test suite.
Prominent security warning: clearly labeled as a dev tool — production secrets stay out.
Fully private: everything happens locally; tokens and secrets are never transmitted.

Building the API those tokens will protect? It needs a home. FistHost web hosting starting at just $0.99 per month includes a free domain and fast servers — prototype your auth flow here, deploy the real thing there.

Pro Tips

Always set an exp claim: tokens without expiry are a security smell — give every token a sensible lifetime.
Keep payloads small and non-sensitive: the payload is readable by anyone holding the token — user IDs and roles yes, passwords and PII never.
Use strong, random secrets: generate a long random string for your HMAC secret — short dictionary words are brute-forceable.
Match the algorithm on both ends: "invalid signature" errors usually mean the verifier is using a different algorithm or secret than the signer.
Decode before you debug: pasting a failing token here shows you exactly what claims it carries — half of auth bugs are visible in the payload.
Prefer HS256 unless you have a reason: it is the most widely supported HMAC option; HS384/HS512 add margin, not magic.
Rotate secrets periodically: in production, have a rotation plan so a leaked secret has a limited blast radius.
Test expiry handling deliberately: generate a token with an exp claim a minute in the future, wait, then watch your API reject it — the fastest way to confirm your expiry logic actually works.
Remember encoding is not encryption: Base64URL just makes bytes URL-safe — treat payload contents as public.

Who Uses This Tool?

Backend developers generating test tokens while building and debugging auth flows.
API developers verifying signatures and inspecting claims from third-party tokens.
Students learning how JWT structure, signing, and verification actually work.
QA engineers crafting tokens with specific claims to test edge cases and expiry handling.

Frequently Asked Questions

Is it safe to paste my tokens here?

For development and test tokens, yes — everything runs locally in your browser and nothing is sent anywhere. For production secrets or real user tokens: no. Use this as a dev tool only, and keep production credentials inside your own infrastructure.

Which signing algorithms are supported?

HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512, computed with the browser's WebCrypto API. HS256 is pre-selected as the most common choice.

Can I see what is inside a token without the secret?

Yes — decoding (reading the header and payload) needs no secret. The secret is only required to verify that the signature is genuine.

Why does signature verification fail?

The usual causes: a different secret than the one used to sign, a different algorithm, or accidental whitespace copied with the token. Decode the token first and compare the alg claim with your settings.

Is the payload encrypted?

No. JWT payloads are Base64URL-encoded, which anyone can decode. Never put passwords, personal data, or secrets in a token's claims.

What claims should I include?

At minimum: sub (who the token is for) and exp (when it expires). iat (issued at) and iss (issuer) are common and useful. Keep custom claims small and non-sensitive.

Can I generate tokens for production use here?

Technically the signatures are real, but you should not: production token issuance belongs in your own backend with secrets managed securely, not in a browser page. Use this tool for development, testing, and learning.

What is the difference between HS256 and RS256?

HS256 uses one shared secret for both signing and verifying — simple, and what this tool supports. RS256 uses a public/private key pair: the server signs with a private key and anyone verifies with the public key. RS256 is better for multi-service setups, but for learning, testing, and single-server apps, HS256 is the pragmatic choice.

How is this different from the JWT Decoder tool?

This workbench both generates signed tokens and decodes them. The standalone JWT Decoder focuses purely on inspection — use whichever fits your current task.

Related Tools

More free FistHost tools for developers: JWT Decoder for quick token inspection, Password Generator for strong secrets, SHA256 Hash Generator, Base64 Encoder Decoder, and Online MD5 Generator.

Ready to ship the API behind those tokens? FistHost web hosting starting at just $0.99 per month comes with a free domain, one-click installs, and fast, reliable servers — debug your auth here, launch it live today.

User Reviews

No reviews yet. Be the first to review this tool!