JWT Builder

A JWT generator is an online tool that creates JSON Web Tokens by combining token claims with a signing secret or key. It saves developers from writing the signing logic manually and is useful for testing auth flows, API integration, and local development.

To verify the token you generate, paste it into the JWT Decoder and validator. That page shows the header and payload, and it can check an HS256 signature. It does not validate RS256.

• Support for standard JWT claims: `iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, and `jti`. Format claim JSON with the JSON Formatter before you sign.
• Custom claim support: add claim rows dynamically and include string or JSON values.
• Flexible datetime parsing: use ISO 8601 values or UNIX timestamps for time-based claims.
• Automatic timestamp conversion: the tool converts supported datetime input into JWT-friendly numeric values.
• HS256 and RS256 signing: use a shared secret for HMAC SHA-256 or an unencrypted PKCS#8 or PKCS#1 RSA private key (2048 bits or stronger) for RSA SHA-256.
• Adaptive signing-key input: the key control and guidance update with the selected algorithm.
• Random secret generation: generate a cryptographically random 32-character Base64URL secret for HS256 testing, or decode segments with the Base64 Converter.
• Copy-ready output and validation feedback: build the token and copy it from the result panel.

1. Fill in the standard claims such as issuer, subject, audience, and expiration time.
2. Add custom claims if needed by clicking Add Claim and entering the claim name and value.
3. Choose HS256 or RS256 as the signing algorithm.
4. Enter the matching signature key: use a shared secret for HS256 or an unencrypted PKCS#8 or PKCS#1 RSA private key (2048 bits or stronger) for RS256.
5. Click Build JWT to create the signed token.
6. Copy the generated token from the output panel and use it in your app or test flow.

This example uses HS256, the placeholder secret your-jwt-secret-key, and fixed claims you can type into the form. Leave custom claims empty, then click Build JWT. Load Sample is not this example: it uses the current time, the issuer codesamplez.com, and the same placeholder secret.

• iss: example-issuer
• sub: user-123
• aud: example-api
• exp: 2030-07-15T12:00:00Z
• iat and nbf: 2030-01-15T12:00:00Z
• jti: example-token-1
• Algorithm: HS256. Shared secret: your-jwt-secret-key

The header is always alg plus typ set to JWT. This page does not add kid or any other header field. The compact header it encodes is:

{"alg":"HS256","typ":"JWT"}

exp, iat, and nbf are stored as seconds. In the order the form writes them, the compact payload is:

{"exp":1910347200,"iat":1894708800,"nbf":1894708800,"iss":"example-issuer","sub":"user-123","aud":"example-api","jti":"example-token-1"}

The signed token is three Base64URL segments separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE5MTAzNDcyMDAsImlhdCI6MTg5NDcwODgwMCwibmJmIjoxODk0NzA4ODAwLCJpc3MiOiJleGFtcGxlLWlzc3VlciIsInN1YiI6InVzZXItMTIzIiwiYXVkIjoiZXhhbXBsZS1hcGkiLCJqdGkiOiJleGFtcGxlLXRva2VuLTEifQ.rGjvaLDaYH15AC3SkgKUlBwqW2poNQapBfo3bQkpNJo

• The first segment is the header above.
• The second segment is the payload above.
• The third segment is the HS256 signature of those two segments joined by a dot. The HMAC key is the UTF-8 text of your-jwt-secret-key. The tool does not Base64-decode that secret before signing.

Paste that token into the JWT Decoder and validator to read the claims. Signature checks there support HS256, which is the algorithm used here.

These snippets sign the same claims with HS256 and the placeholder secret your-jwt-secret-key. Use them only as a local test. jsonwebtoken 9 and PyJWT 2 produce the token in the example above. firebase/php-jwt 6 writes typ before alg in the header, so its encoded string differs; the payload, algorithm, and secret are the same.

Node.js (jsonwebtoken)

const jwt = require('jsonwebtoken');

const token = jwt.sign({
  exp: 1910347200,
  iat: 1894708800,
  nbf: 1894708800,
  iss: 'example-issuer',
  sub: 'user-123',
  aud: 'example-api',
  jti: 'example-token-1'
}, 'your-jwt-secret-key', { algorithm: 'HS256' });

Python (PyJWT)

import jwt

token = jwt.encode({
    "exp": 1910347200,
    "iat": 1894708800,
    "nbf": 1894708800,
    "iss": "example-issuer",
    "sub": "user-123",
    "aud": "example-api",
    "jti": "example-token-1",
}, "your-jwt-secret-key", algorithm="HS256")

PHP (firebase/php-jwt)

use Firebase\JWT\JWT;

$token = JWT::encode([
    'exp' => 1910347200,
    'iat' => 1894708800,
    'nbf' => 1894708800,
    'iss' => 'example-issuer',
    'sub' => 'user-123',
    'aud' => 'example-api',
    'jti' => 'example-token-1',
], 'your-jwt-secret-key', 'HS256');

For the RS256 option on this page, give those libraries an unencrypted PKCS#8 or PKCS#1 RSA private key of 2048 bits or stronger and set the algorithm to RS256. Encrypted keys and public keys are rejected here.

iss, sub, aud, exp, nbf, iat, and jti are all optional. A blank field is left out of the payload. iss, sub, aud, and jti are stored as strings.

exp, iat, and nbf accept an ISO 8601 value such as 2030-01-15T12:00:00Z or a UNIX timestamp in seconds with at least 10 digits. The tool writes a number of seconds. A short integer such as 2030 is rejected. Leave exp empty when you want no expiration claim. The +1h, +24h, and +7d buttons set exp from the current time. Now sets iat or nbf to the current time.

Add Claim appends a custom claim. A value that is valid JSON keeps that type, including booleans, numbers, arrays, and objects. A number literal that JavaScript cannot store exactly stays a string. Any other text stays a string.

The algorithm selector offers HS256 and RS256 only.

• HS256 signs with HMAC SHA-256. The key is the UTF-8 text in Shared Secret. Generate fills a 32-character Base64URL test secret and does not Base64-decode it.
• RS256 signs with RSASSA-PKCS1-v1_5 and SHA-256. Paste an unencrypted PKCS#8 key (BEGIN PRIVATE KEY) or PKCS#1 key (BEGIN RSA PRIVATE KEY) of 2048 bits or stronger. Encrypted keys and public keys are rejected.

This generator supports the standard claims defined by the JWT specification.

• iss (Issuer): identifies who issued the token.
• sub (Subject): identifies the principal the token refers to, often a user ID.
• aud (Audience): specifies the intended recipient such as an API or service.
• exp (Expiration Time): defines when the token becomes invalid.
• nbf (Not Before): defines the earliest time the token is valid.
• iat (Issued At): records when the token was issued.
• jti (JWT ID): provides a unique identifier for the token.

• Checks for missing required fields such as the algorithm-specific signing key. Issuer and expiration are optional per RFC 7519.
• Validates supported datetime formats before token generation.
• Parses JSON-style custom claim values when possible — including booleans, numbers, arrays, and objects — and falls back safely to strings. Numeric literals whose exact value cannot be represented as a JavaScript number (e.g. very large identifiers) keep their string form.
• Explains malformed, unsupported, or public RSA keys without exposing sensitive values.
• Reports when Web Crypto is unavailable separately from RSA key-format errors.
• Keeps the result area clear when generation fails so invalid output is not reused accidentally.

• Client-side only: no claim data, shared secrets, or private keys are sent to a server.
• Web Crypto based signing: cryptographic operations use browser APIs.
• No key storage: the signature key is used in memory only.
• Best for testing and development: avoid using production secrets or private keys in any browser tool.

The JWT Generator works in modern browsers that support:

• Web Crypto API
• TextEncoder API
• Clipboard support for copy actions
• ES6+ JavaScript features

• Frontend: Pure HTML, CSS, and JavaScript rendered through the CodeSamplez tool shell.
• Cryptography: Web Crypto API with HMAC SHA-256 (HS256) and RSASSA-PKCS1-v1_5 SHA-256 (RS256) signing.
• Encoding: Base64URL handling for JWT header, payload, and signature segments.
• Input processing: datetime parsing, JSON custom-claim parsing, and validation feedback.

Please get in touch with us for any bug report, feature request, or feedback about the JWT Generator.

This generator builds a signed JSON Web Token from the claims you enter, using HS256 or RS256, in the browser. These tutorials explain how JSON Web Tokens are structured, how to handle them, and how one authentication design uses them between services.

• JSON Web Token crash course
• JWT best practices
• JWT authentication in microservices

Is this JWT generator free to use?

Yes. The CodeSamplez JWT Generator is completely free to use and runs directly in your browser.

Which algorithms does the JWT Generator support?

The tool supports HS256 with a shared secret and RS256 with an unencrypted PKCS#8 or PKCS#1 RSA private key that is 2048 bits or stronger.

Can I verify or decode a JWT here?

This page is focused on token creation. Use the CodeSamplez JWT Decoder to inspect an existing token; its signature validation currently supports HS256.

Do JWTs expire?

They can. JWTs expire when you include the exp claim, and setting an expiration time is recommended for better security.

Is using an online JWT generator safe?

For testing and development, yes. This generator works locally in your browser so claims and signing keys are not sent to a server, but you should still avoid pasting production secrets, private keys, or sensitive payloads into any online tool.

How do I create a JWT token online?

Enter the claims you need, choose HS256 or RS256, provide the matching signing key, and click Build JWT. The signed token appears under Generated JWT. Load Sample fills example claims, selects HS256, and sets the placeholder secret your-jwt-secret-key. Signing stays in your browser.

Is it safe to generate a JWT in the browser?

This page signs with the Web Crypto API and does not upload the claims or the key. They stay in memory for this page only. HS256 uses the shared-secret text as UTF-8 bytes. RS256 uses the PEM private key you paste. The placeholder secret and the Generate button are for local tests, so do not type a production secret or private key here.

What shared-secret length should I use for HS256?

The HS256 secret field accepts any non-empty string and does not enforce a minimum length. Generate fills a 32-character Base64URL test secret. The sample value your-jwt-secret-key is a placeholder, not a strong secret. For anything besides a local test, use a long random secret and do not reuse the placeholder.

How do I set an expiration when I create a JWT token?

Type an ISO 8601 time such as 2030-07-15T12:00:00Z in Expiration Time (exp), or a UNIX timestamp in seconds with at least 10 digits. The tool stores that as a number of seconds. The +1h, +24h, and +7d buttons set exp from the current time. Leave exp empty to omit it. A short number such as a year is rejected.