JWT Generator
Create JSON Web Tokens with custom claims and HMAC-SHA signing. Everything runs in your browser using the Web Crypto API — your secret key never leaves your device.
Header
Payload
Signature
About JWT Generation
JSON Web Tokens (JWTs) are compact, URL-safe tokens used for securely transmitting information between parties. A JWT consists of three Base64URL-encoded parts separated by dots: the header, the payload, and the signature. This tool lets you build custom JWTs with standard and custom claims, signed with HMAC-SHA algorithms.
Standard JWT Claims
| Claim | Name | Description |
|---|---|---|
iss | Issuer | Identifies the principal that issued the JWT |
sub | Subject | Identifies the subject of the JWT (e.g. user ID) |
aud | Audience | Identifies the recipients the JWT is intended for |
exp | Expiration | Unix timestamp after which the JWT must not be accepted |
nbf | Not Before | Unix timestamp before which the JWT must not be accepted |
iat | Issued At | Unix timestamp when the JWT was issued |
jti | JWT ID | Unique identifier for the JWT to prevent replay attacks |
HMAC Signing Algorithms
| Algorithm | Hash Function | Signature Size | Recommended Key Length |
|---|---|---|---|
| HS256 | SHA-256 | 256 bits | 256 bits (32 bytes) |
| HS384 | SHA-384 | 384 bits | 384 bits (48 bytes) |
| HS512 | SHA-512 | 512 bits | 512 bits (64 bytes) |