JWT Generator
Build a signed HS256 JSON Web Token: edit the payload, add expiry, sign with your secret. Signing uses the Web Crypto API and never leaves your browser.
Colours: header . payload . signature. Paste this into the JWT decoder or into jwt.io (with the same secret) to verify it.
How a JWT is built
A JSON Web Token is three Base64url-encoded parts joined by dots:
header.payload.signature. The header names the algorithm, the payload holds your
claims, and the signature is a keyed hash of the first two parts. For HS256 that hash is
HMAC-SHA256 computed with your secret. Change a single character of the header or payload and
the signature no longer matches, which is exactly how a verifier detects tampering.
Signing proves two things
A valid signature tells the verifier the token was not altered in transit and was created by someone who holds the secret. What it does not do is hide anything. The payload is only encoded, so treat every claim as public. This is the single most common JWT mistake: putting a password, a session secret or personal data in the payload because it "looks" scrambled. It is not - the JWT decoder or a line of Base64 will reveal it instantly.
Timestamps and expiry
Two claims control a token's lifetime. iat records when it was issued and
exp when it expires, both in Unix seconds. The quick-add buttons above fill these
for you. Give access tokens a short exp - an hour is typical - so a stolen token
is useless within minutes rather than forever. To read a raw exp back into a date,
the Unix timestamp converter does the epoch maths, and the
JSON formatter tidies a payload before you sign it.