JWT Builder
NewCreate and sign JWT tokens — set header, payload, and secret to generate a valid token.
Token Breakdown
HMAC-SHA256(base64url(header) + "." + base64url(payload), secret)
⚠️ This tool generates tokens for testing only. For production use a proper server-side JWT library. The secret key is never sent anywhere — everything runs in your browser.
Frequently Asked Questions
Can this generate RS256 or ES256 tokens?
No. The tool only supports HS256, HS384, and HS512, and it signs them with browser Web Crypto HMAC. There is no RSA or ECDSA key handling in this component.
Is the JWT payload hidden or encrypted?
No. This tool signs tokens; it does not encrypt them. Anyone who gets the token can still base64url-decode the header and payload, so don't put secrets in those claims.
What happens if my header or payload JSON is invalid?
The build stops immediately and shows a specific error for the Header or Payload field. It won't try to sign until both JSON blocks parse successfully.
What do the '+ Add exp' and '+ Add iat' buttons insert?
They edit the payload JSON in place using Unix time in seconds. iat is set to 'now', and exp is set to one hour from now, but only if the current payload already parses as valid JSON.
Does it rebuild the token as I type?
Not quite. Changing the header, payload, algorithm, or secret clears the previously generated token and hides the breakdown, but you still need to click 'Build JWT' to sign a fresh token.
Related Tools
JWT Decoder
Decode and inspect JWT tokens — header, payload, and signature — without verification.
Random String Generator
Generate cryptographically secure random strings, tokens, and API keys.
cURL Builder
NewBuild cURL commands visually — set method, headers, auth, body, and options with a live cURL output.