JWT Encoder and Generator
Make a signed JSON Web Token for testing an API or reproducing a bug. Write the claims as JSON, add issued-at and expiry times with a click, enter the secret and copy the token.
How to create a JWT
- 1Choose the algorithm and edit the payload JSON.
- 2Enter the secret your API uses.
- 3Copy the token and send it, usually as Authorization: Bearer <token>.
The three parts
A JWT is a Base64URL header ({"alg": "HS256", "typ": "JWT"}), a Base64URL payload with your claims, and a signature over both, made with the secret. The parts are colored in the result.
Times
iat (issued at) and exp (expires) are Unix times in seconds. “Issued now” and “Expires in 1 hour” fill them in for you.
Secrets
Use a long random secret, at least 32 characters for HS256; short secrets can be guessed offline from any token. Turn on Base64 if your secret is stored that way.
Frequently asked questions
- Is my secret sent anywhere?
- No. The token is signed in your browser with Web Crypto.
- Does it support RS256 or ES256?
- Not yet; those sign with a private key. This tool covers the HMAC algorithms HS256, HS384 and HS512.
- How do I read a token?
- Paste it into JWT Decoder to see the header and claims and check the signature.