SEOlust logo SEOlust
Developer & Utilities

JWT Generator & Encoder

Create and sign JSON Web Tokens (JWT) in your browser — edit header and payload, pick HS256/384/512, and get a signed token. Your secret never leaves your device. Free.

All tools
—

🔒 Private by design

  • The token is signed locally in your browser with the Web Crypto API — your secret never leaves your device.
  • Supports HMAC algorithms (HS256, HS384, HS512).
  • Remember: the header and payload are only base64url-encoded, not encrypted — never put secrets in the payload.

Free JWT Generator & Encoder

Create and sign JSON Web Tokens (JWT) in your browser. Edit the header and payload, choose HS256, HS384, or HS512, enter your secret, and get a signed token instantly. Everything is signed locally with the Web Crypto API, so your secret never leaves your device. Free, no sign-up.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It is made of three parts separated by dots: a header describing the algorithm, a payload holding the claims (such as a user ID or expiry time), and a signature that proves the token has not been tampered with. JWTs are widely used for authentication and stateless sessions in APIs and single-page apps.

The three parts of a JWT

Each token encodes three sections:

  • Header — the token type and signing algorithm, for example HS256.
  • Payload — the claims, base64url-encoded (not encrypted).
  • Signature — an HMAC of the header and payload using your secret, which verifies integrity.
  • The three parts are joined with dots: header.payload.signature.

How to generate a JWT

It is instant:

  • Edit the header and payload JSON to include your claims.
  • Pick an HMAC algorithm — HS256, HS384, or HS512.
  • Enter the secret key used to sign the token.
  • Copy the signed token, which updates live as you type.

Common JWT claims

The payload often uses a set of standard registered claims: sub (subject, usually a user ID), iat (issued-at timestamp), exp (expiry timestamp), iss (issuer), and aud (audience). You can also add your own custom claims like name or role. Timestamps are in seconds since the Unix epoch. Including an exp claim is strongly recommended so tokens do not stay valid forever.

Security: what a JWT does and does not protect

A signed JWT guarantees integrity — if anyone changes the header or payload, the signature no longer matches and the token is rejected. But it does not provide confidentiality: the payload is only base64url-encoded and can be read by anyone who has the token. Never put passwords or sensitive data in the payload. Keep your signing secret private and strong, since anyone with the secret can forge valid tokens.

Pro tip

Use a long, random secret (at least 256 bits for HS256) and store it securely on your server, never in client-side code. Always set an exp claim to limit a token's lifetime. To inspect or debug an existing token, use our JWT Decoder.

FAQ

Is this JWT generator free and private?
Yes. It is free and signs tokens entirely in your browser using the Web Crypto API, so your secret and data never leave your device.
Which algorithms does it support?
It supports the HMAC algorithms HS256, HS384, and HS512, which sign the token with a shared secret.
Is the JWT payload encrypted?
No. The payload is only base64url-encoded, which anyone with the token can decode and read. Never store passwords or sensitive information in it. Signing protects integrity, not confidentiality.
What should I use as the secret?
Use a long, random, high-entropy secret — at least 256 bits for HS256 — and keep it private on your server. Anyone who knows the secret can forge valid tokens.
How do I make a JWT expire?
Add an exp claim to the payload with a Unix timestamp (in seconds) for when it should expire. Your verifying code then rejects tokens past that time.
What is the difference between HS256 and RS256?
HS256 uses a single shared secret for both signing and verifying (HMAC). RS256 uses a private key to sign and a public key to verify (RSA). This tool generates HMAC-signed tokens (HS256/384/512).
How do I verify or read a token I generated?
Use a JWT decoder to inspect the header and payload, and verify the signature with the same secret and algorithm. Our JWT Decoder can read the contents of any token.

Related tools

Pro tip: pair this tool with Upside Down Text Generator and Text Similarity Checker for a faster SEO workflow.