JWT Generator
Generate signed JSON Web Tokens with custom header, payload and secret. Supports HS256, RS256, ES256 algorithms.
What is a JWT?
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a compact JSON object. It consists of three parts separated by dots: Header.Payload.Signature.
What are the common use cases for JWT?
JWT is widely used for authentication (single sign-on), API authorization, and secure information exchange. After login, the server issues a JWT that the client includes in subsequent requests to prove identity.
How do I choose between HS256, RS256, and ES256?
HS256 uses a shared secret and is fastest, suitable for single-service apps. RS256 uses RSA key pairs and is better for multi-service architectures. ES256 uses elliptic curve keys, offering strong security with shorter signatures.
What are JWT claims?
Claims are statements in the payload. Registered claims include iss (issuer), sub (subject), exp (expiration), aud (audience). Public claims can be registered with IANA. Private claims are custom fields agreed between parties.
How do I verify a JWT?
To verify a JWT, decode the header to get the algorithm, then use the appropriate key (shared secret for HMAC, public key for RSA/ECDSA) to verify the signature. Also check exp, iss, and aud claims.
Is it safe to generate JWTs in the browser?
Yes, this tool uses the Web Crypto API for all cryptographic operations. Your keys and tokens never leave your browser. No data is sent to any server.
What is the difference between encoding and signing?
Encoding (Base64) just converts data to a transmittable format and is reversible by anyone. Signing creates a cryptographic hash that proves the token hasn't been tampered with and can only be verified with the correct key.
Can JWT be encrypted, not just signed?
Yes, JWE (JSON Web Encryption) encrypts the payload content so it cannot be read without the decryption key. Standard JWT (JWS) only ensures integrity but the payload is readable by anyone who has the token.
What are JWT security best practices?
Always set short expiration times (exp claim). Use strong, randomly generated secrets for HMAC. Store private keys securely for RSA/ECDSA. Never put sensitive data in the payload since it's only Base64 encoded. Use HTTPS in production.
How does JWT compare to session-based authentication?
JWT is stateless — the server doesn't store session data, making it ideal for microservices and cross-domain scenarios. Sessions require server-side storage but allow instant revocation. JWT revocation requires additional mechanisms like blocklists.
Is JWT suitable for logout and session management?
JWT is stateless by design, so server-side logout requires extra steps like token blocklists or short expiration with refresh tokens. For simple logout, use short-lived access tokens (e.g., 15 minutes) paired with longer refresh tokens.
How does the refresh token pattern work with JWT?
Use a short-lived access token (JWT) for API calls and a longer-lived refresh token for obtaining new access tokens. When the access token expires, the client sends the refresh token to get a new JWT without re-authenticating.
What is the "none" algorithm?
The "none" algorithm means the JWT is unsigned — no signature verification. This should only be used for testing, as unsigned tokens can be tampered with freely. Many libraries disable it by default for security.
What are the size limitations of a JWT?
JWT has no fixed size limit, but since it's sent in HTTP headers (typically Authorization header), it should stay under 4KB to avoid issues. Keep payloads minimal — only include necessary claims.