JWT Generator
Generate signed JSON Web Tokens with custom header, payload and secret. Supports HS256, RS256, ES256 algorithms.
What is a JWT?
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a compact JSON object. It consists of three parts separated by dots: Header.Payload.Signature.
What are the common use cases for JWT?
JWT is widely used for authentication (single sign-on), API authorization, and secure information exchange. After login, the server issues a JWT that the client includes in subsequent requests to prove identity.
How do I choose between HS256, RS256, and ES256?
HS256 uses a shared secret and is fastest, suitable for single-service apps. RS256 uses RSA key pairs and is better for multi-service architectures. ES256 uses elliptic curve keys, offering strong security with shorter signatures.
What are JWT claims?
Claims are statements in the payload. Registered claims include iss (issuer), sub (subject), exp (expiration), aud (audience). Public claims can be registered with IANA. Private claims are custom fields agreed between parties.
How do I verify a JWT?
To verify a JWT, decode the header to get the algorithm, then use the appropriate key (shared secret for HMAC, public key for RSA/ECDSA) to verify the signature. Also check exp, iss, and aud claims.
Is it safe to generate JWTs in the browser?
Yes, this tool uses the Web Crypto API for all cryptographic operations. Your keys and tokens never leave your browser. No data is sent to any server.
What is the difference between encoding and signing?
Encoding (Base64) just converts data to a transmittable format and is reversible by anyone. Signing creates a cryptographic hash that proves the token hasn't been tampered with and can only be verified with the correct key.
Can JWT be encrypted, not just signed?
Yes, JWE (JSON Web Encryption) encrypts the payload content so it cannot be read without the decryption key. Standard JWT (JWS) only ensures integrity but the payload is readable by anyone who has the token.
What are JWT security best practices?
Always set short expiration times (exp claim). Use strong, randomly generated secrets for HMAC. Store private keys securely for RSA/ECDSA. Never put sensitive data in the payload since it's only Base64 encoded. Use HTTPS in production.
How does JWT compare to session-based authentication?
JWT is stateless — the server doesn't store session data, making it ideal for microservices and cross-domain scenarios. Sessions require server-side storage but allow instant revocation. JWT revocation requires additional mechanisms like blocklists.
Is JWT suitable for logout and session management?
JWT is stateless by design, so server-side logout requires extra steps like token blocklists or short expiration with refresh tokens. For simple logout, use short-lived access tokens (e.g., 15 minutes) paired with longer refresh tokens.
How does the refresh token pattern work with JWT?
Use a short-lived access token (JWT) for API calls and a longer-lived refresh token for obtaining new access tokens. When the access token expires, the client sends the refresh token to get a new JWT without re-authenticating.
What is the "none" algorithm?
The "none" algorithm means the JWT is unsigned — no signature verification. This should only be used for testing, as unsigned tokens can be tampered with freely. Many libraries disable it by default for security.
What are the size limitations of a JWT?
JWT has no fixed size limit, but since it's sent in HTTP headers (typically Authorization header), it should stay under 4KB to avoid issues. Keep payloads minimal — only include necessary claims.
How to Use JWT Generator
Create signed JSON Web Tokens with a custom header, payload and secret or key. Choose HS256/384/512, RS256/384/512 or ES256/384/512 — all generated locally in your browser.
- Select an algorithm from the dropdown: HS256, HS384 or HS512 for shared secrets, RS256/384/512 or ES256/384/512 for key pairs, or 'none' for an unsigned token.
- Edit the header and payload JSON, for example adding claims like sub, iss and exp.
- Enter your secret (for HS* algorithms) or paste your private key (for RS* and ES* algorithms).
- Generate the token and copy the resulting dot-separated JWT into your API requests or tests.
'none' produces an unsigned token that most servers will reject — use it only for debugging.
Related Tools
- JWT Decoder Free online JWT decoder. Decode JSON Web Tokens instantly to view header, payload and signature. No registration required.
- File Hash Checker Calculate and verify MD5, SHA-1, SHA-256, SHA-512 file hashes locally
- Chmod Calculator Free online chmod calculator to visualize and calculate Linux file permissions with checkboxes. Instantly convert between numeric (755, 644) and symbolic notation (rwxr-xr-x). Supports special permissions like setuid, setgid, sticky bit.
- ASCII Table Complete ASCII character encoding reference with decimal, hexadecimal, octal, binary codes, HTML entities, and character descriptions. Search and filter instantly.
- Hex Viewer View file contents in hex dump format with search, offset navigation, and virtual scrolling
- HTTP Request Tester Test REST APIs directly in your browser. Send GET, POST, PUT, DELETE requests with custom headers, body, and query parameters. View response status, headers, and JSON body instantly.
- .htaccess Generator Generate Apache .htaccess rules for redirects, rewrites, security headers, caching, compression, and more.
- Robots.txt Generator Free online robots.txt generator. Create and customize robots.txt files to control search engine crawling, manage crawler access, and optimize your site's SEO with an easy visual editor.