Advertisement
Guide
About the JWT Builder
This tool builds and signs a JSON Web Token from a payload you define. You choose the claims — subject, audience, expiry, custom fields — pick an algorithm (an HMAC one such as HS256 with a shared secret, or RS256, ES256 or EdDSA with a private key you paste or generate here), and and it produces a complete, signed token ready to drop into an Authorization: Bearer header. It's the counterpart to the JWT Decoder: build here, inspect there.
Signing happens in your browser with the Web Crypto API, so your secret and payload never reach a server. That makes it safe for experimenting, building test fixtures, and understanding exactly how a token is assembled.
How a signed JWT is assembled
The header and payload are each serialized to JSON and Base64URL-encoded, then joined with a dot. That string is signed with your secret using the chosen HMAC algorithm, and the Base64URL signature is appended as the third segment. The result is header.payload.signature. Anyone can read the first two parts, but only someone with the secret can produce a matching signature — which is what makes the token trustworthy.
Choosing an expiry
Set the exp claim to a sensible lifetime — minutes to hours for access tokens, longer for refresh tokens. Short-lived tokens limit the damage if one leaks. Keep your signing secret long and random (a generated passphrase works well), because the security of every token you issue rests on it staying secret.
How to use it
- 1Edit the payload with your claims (sub, custom fields, and so on).
- 2Set an expiration so the token is not valid forever.
- 3Choose the algorithm, then enter a secret (HMAC) or paste or generate a private key.
- 4Copy the signed token and verify it in the JWT Decoder.
Frequently asked questions
What is the difference between the JWT Builder and Decoder?
The Builder creates and signs a new token from a payload and secret. The Decoder reads an existing token's header and payload. Use them together to build and then inspect tokens.
Which algorithm should I choose?
HS256 (HMAC-SHA256) is the most widely used and a safe default. HS384 and HS512 use longer hashes; pick whichever your backend expects.
Can I create RS256 or ES256 tokens here?
Yes. Pick RS256, PS256, ES256 or EdDSA and paste a PKCS#8 private key (or a JWK), or click “Generate key pair”. The public key is shown as PEM and as a JWKS you can serve from /.well-known/jwks.json for verifiers.
How long should an HS256 secret be?
At least 32 bytes for HS256, 48 for HS384 and 64 for HS512 (RFC 7518). Short or guessable secrets can be cracked offline from a single token. The Random button makes one of the right length.
Is my secret sent anywhere?
No. Signing is performed locally with the Web Crypto API. The payload and secret never leave your browser.
Should I use tokens generated here in production?
This is great for testing and learning. For production, generate and sign tokens on your server with a securely stored secret, never in client-side code shipped to users.