JWT Builder

A JWT generator is an online tool that creates JSON Web Tokens by combining token claims with a signing secret or key. It saves developers from writing the signing logic manually and is useful for testing auth flows, API integration, and local development.

Need to inspect an existing token instead? Use the JWT Decoder and validator.

• Support for standard JWT claims: `iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, and `jti`.
• Custom claim support: add claim rows dynamically and include string or JSON values.
• Flexible datetime parsing: use ISO 8601 values or UNIX timestamps for time-based claims.
• Automatic timestamp conversion: the tool converts supported datetime input into JWT-friendly numeric values.
• HS256 and RS256 signing: use a shared secret for HMAC SHA-256 or an unencrypted PKCS#8 RSA private key (2048 bits or stronger) for RSA SHA-256.
• Adaptive signing-key input: the key control and guidance update with the selected algorithm.
• Random secret generation: generate a cryptographically random 32-character Base64URL secret for HS256 testing.
• Copy-ready output and validation feedback: build the token and copy it from the result panel.

1. Fill in the standard claims such as issuer, subject, audience, and expiration time.
2. Add custom claims if needed by clicking Add Claim and entering the claim name and value.
3. Choose HS256 or RS256 as the signing algorithm.
4. Enter the matching signature key: use a shared secret for HS256 or an unencrypted PKCS#8 RSA private key (2048 bits or stronger) for RS256.
5. Click Build JWT to create the signed token.
6. Copy the generated token from the output panel and use it in your app or test flow.

This generator supports the standard claims defined by the JWT specification.

• iss (Issuer): identifies who issued the token.
• sub (Subject): identifies the principal the token refers to, often a user ID.
• aud (Audience): specifies the intended recipient such as an API or service.
• exp (Expiration Time): defines when the token becomes invalid.
• nbf (Not Before): defines the earliest time the token is valid.
• iat (Issued At): records when the token was issued.
• jti (JWT ID): provides a unique identifier for the token.

• Checks for missing required fields such as the algorithm-specific signing key, issuer, and expiration time.
• Validates supported datetime formats before token generation.
• Parses JSON-style custom claim values when possible and falls back safely to strings.
• Explains malformed, unsupported, or public RSA keys without exposing sensitive values.
• Reports when Web Crypto is unavailable separately from RSA key-format errors.
• Keeps the result area clear when generation fails so invalid output is not reused accidentally.

• Client-side only: no claim data, shared secrets, or private keys are sent to a server.
• Web Crypto based signing: cryptographic operations use browser APIs.
• No key storage: the signature key is used in memory only.
• Best for testing and development: avoid using production secrets or private keys in any browser tool.

The JWT Generator works in modern browsers that support:

• Web Crypto API
• TextEncoder API
• Clipboard support for copy actions
• ES6+ JavaScript features

• Frontend: Pure HTML, CSS, and JavaScript rendered through the CodeSamplez tool shell.
• Cryptography: Web Crypto API with HMAC SHA-256 (HS256) and RSASSA-PKCS1-v1_5 SHA-256 (RS256) signing.
• Encoding: Base64URL handling for JWT header, payload, and signature segments.
• Input processing: datetime parsing, JSON custom-claim parsing, and validation feedback.

Please get in touch with us for any bug report, feature request, or feedback about the JWT Generator.

Is this JWT generator free to use?

Yes. The CodeSamplez JWT Generator is completely free to use and runs directly in your browser.

Which algorithms does the JWT Generator support?

The tool supports HS256 with a shared secret and RS256 with an unencrypted PKCS#8 RSA private key that is 2048 bits or stronger.

Can I verify or decode a JWT here?

This page is focused on token creation. Use the CodeSamplez JWT Decoder to inspect an existing token; its signature validation currently supports HS256.

Do JWTs expire?

They can. JWTs expire when you include the exp claim, and setting an expiration time is recommended for better security.

Is using an online JWT generator safe?

For testing and development, yes. This generator works locally in your browser so claims and signing keys are not sent to a server, but you should still avoid pasting production secrets, private keys, or sensitive payloads into any online tool.