JWT Generator
Create JSON Web Tokens for authentication, API access, and secure data exchange. This tool helps developers generate properly formatted JWTs with custom claims and headers.
Key Features
- Custom header configuration (algorithm selection)
- Standard and custom claim support
- Expiration time configuration
- Base64URL encoding output
- Copy-ready token format
When to Use This Tool
Use this when you need to create test tokens for API development, prototype authentication flows, or understand JWT structure for debugging.
Example
A typical generated JWT might look like: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
JWT Structure Explained
JSON Web Tokens consist of three Base64URL-encoded parts separated by dots:
1. Header: Contains the token type ("JWT") and signing algorithm (e.g., HS256, RS256) 2. Payload: Contains claims—statements about the user and additional metadata 3. Signature: Created by signing the header and payload with a secret key
Each part can be decoded independently, but only the signature verification confirms the token's integrity.
Standard JWT Claims Reference
| Claim | Name | Description |
|---|---|---|
| iss | Issuer | Identifies who issued the token |
| sub | Subject | Identifies the user or entity |
| aud | Audience | Intended recipient(s) of the token |
| exp | Expiration | Unix timestamp when token expires |
| nbf | Not Before | Unix timestamp when token becomes valid |
| iat | Issued At | Unix timestamp when token was created |
| jti | JWT ID | Unique identifier for this token |
Common JWT Algorithms
| Algorithm | Type | Description | Use Case |
|---|---|---|---|
| HS256 | Symmetric | HMAC with SHA-256 | Simple APIs with shared secret |
| HS384 | Symmetric | HMAC with SHA-384 | Higher security symmetric signing |
| HS512 | Symmetric | HMAC with SHA-512 | Maximum symmetric security |
| RS256 | Asymmetric | RSA with SHA-256 | Distributed systems, public verification |
| RS384 | Asymmetric | RSA with SHA-384 | Higher security asymmetric signing |
| RS512 | Asymmetric | RSA with SHA-512 | Maximum asymmetric security |
| ES256 | Asymmetric | ECDSA with P-256 | Mobile apps, smaller signatures |
| PS256 | Asymmetric | RSA-PSS with SHA-256 | Modern RSA replacement |
Where JWTs Are Used
JWTs have become the standard for modern authentication and authorization:
- Single Sign-On (SSO): Share authentication across multiple applications and services
- API Authentication: Secure REST and GraphQL APIs with stateless token verification
- OAuth 2.0 / OpenID Connect: Industry-standard protocols use JWTs for access and identity tokens
- Microservices: Pass user context between services without database lookups
- Mobile Applications: Lightweight authentication for iOS and Android apps
- Third-Party Integrations: Securely exchange data with external services
Pro Tips
- Set appropriate expiration times (15-60 minutes for access tokens)
- Use RS256 for production systems that need signature verification across services
- Include only essential claims to minimize token size
Security Considerations
1. Signature verification: Always verify the signature on your server—never trust unverified tokens 2. Algorithm confusion: Validate the "alg" header to prevent attackers from using "none" or switching from RS256 to HS256 3. Token storage: Use httpOnly cookies when possible; localStorage is vulnerable to XSS attacks 4. Minimal payload: Include only necessary data—tokens should be small and not contain sensitive information 5. Token lifetime: Use short-lived access tokens (15-60 minutes) with refresh token rotation 6. Secret management: Keep signing keys secure; rotate them periodically; never expose them in client-side code 7. Token revocation: Plan for emergency revocation using token blacklists, version numbers, or short lifetimes