📖 What is JWT Generator?
JWT Generator creates JSON Web Tokens with custom header, payload claims and signing. Set the algorithm (HS256, HS384, HS512), add standard claims (iss, sub, exp, iat) and custom data, then generate a signed token. Use it for testing API authentication, creating mock tokens for development, or learning JWT structure. Everything runs in your browser — your signing secret never leaves your computer.
💡 Example
Input
Payload: {"sub":"user123","name":"Alice","role":"admin"}
Secret: my-secret
Algorithm: HS256
Output
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IkFsaWNlIiwicm9sZSI6ImFkbWluIn0.signature...
🛠️ Common Use Cases
- Creating test JWT tokens for API development and debugging
- Generating mock authentication tokens for frontend development
- Testing API endpoints that require JWT authentication
- Learning JWT structure (header, payload, signature)
- Creating tokens with specific claims for integration testing
📝 Standard JWT Claims
iss — issuer (who created the token)sub — subject (who the token is about)aud — audience (who the token is intended for)exp — expiration time (Unix timestamp)iat — issued at (Unix timestamp)nbf — not before (token not valid before this time)jti — JWT ID (unique identifier)
⚠️ Common Mistakes
- No expiration — always set
exp. Tokens without expiry are valid forever if compromised. - Sensitive data in payload — JWT payloads are Base64-encoded, not encrypted. Never put passwords or secrets in claims.
- Weak secrets — use at least 256-bit random secrets for HS256. Short passwords are vulnerable to brute-force.
❓ Frequently Asked Questions
Can I use generated tokens in production? ▾
These tokens are for testing and development. For production, generate tokens server-side with proper secrets and key management.
What is the difference between HS256 and RS256? ▾
HS256 uses a shared secret (symmetric). RS256 uses a public/private key pair (asymmetric). RS256 is preferred when multiple services need to verify tokens.
How do I set token expiration? ▾
Set the exp claim to a Unix timestamp. For example, current time + 3600 gives a 1-hour expiry. Use the
Timestamp Converter to calculate Unix timestamps.
Is my data private? ▾
Yes — all processing runs entirely in your browser. Your data is never sent to any server.
Is this tool free? ▾
Completely free — no login, no usage limits, works offline once loaded.
Yes — completely free, no login required, no usage limits.
Is my data private? ▾
Yes — all processing runs in your browser. Your data is never sent to any server.
Does it work offline? ▾
Yes — once the page is loaded, the tool works without an internet connection.