Usually a user ID or unique identifier
Add custom claims as JSON object
Generated tokens use real HMAC-SHA256 signatures. Use a strong secret key in production. For testing only - do not use in production without proper security review.
How to Generate and Decode JWT Tokens Online
- 1
Choose a signing algorithm
Select your preferred signing algorithm such as HS256 (HMAC-SHA256). HS256 is the most common choice for symmetric signing where both parties share the same secret key. - 2
Enter your secret key and claims
Provide a strong secret key for signing. Then fill in standard claims like subject (sub), expiration time, and any custom claims your application requires, such as user roles or permissions. - 3
Generate the JWT
Click Generate JWT to create a signed token. The tool produces a valid three-part token (header.payload.signature) that you can copy and use immediately in your API requests or test environments. - 4
Verify and decode the token
Use our JWT Decoder to inspect the generated token. You can verify the header, payload claims, and signature are correct before using the token in your authentication flow.
Common Use Cases
API Authentication Testing
OAuth and SSO Flow Development
Debugging Token Issues
Creating Mock JWTs for Unit Tests
Why Use JWT Generator?
A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit information between parties. Every JWT consists of three parts separated by dots: a header that specifies the token type and signing algorithm, a payload containing the claims (data), and a signature that verifies the token has not been tampered with. The header and payload are Base64-encoded, making them easy to inspect but not encrypted. The signature is produced by hashing the encoded header and payload together with a secret key.
The most widely used signing algorithms are HS256 (HMAC-SHA256) and RS256 (RSA-SHA256). HS256 uses a single shared secret for both signing and verification, making it simple and fast for server-to-server communication. RS256 uses an asymmetric key pair where the private key signs and the public key verifies, which is ideal for distributed systems and third-party integrations. You can use our SHA-256 Hash Generator to experiment with the underlying SHA-256 hashing that powers these algorithms.
Standard JWT claims include iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), and iat (issued at). Custom claims let you attach application-specific data like user roles, permissions, or tenant IDs. This JWT token generator creates valid, signed tokens entirely in your browser, so your secret keys and payloads are never sent to any server. For decoding and inspecting existing tokens, try the JWT Decoder.