JWT Builder

A JWT generator is an online tool that creates JSON Web Tokens by combining token claims with a signing secret or key. It saves developers from writing the signing logic manually and is useful for testing auth flows, API integration, and local development.

Need to inspect an existing token instead? Use the JWT Decoder and validator.

• Support for standard JWT claims: `iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, and `jti`.
• Custom claim support: add claim rows dynamically and include string or JSON values.
• Flexible datetime parsing: use ISO 8601 values or UNIX timestamps for time-based claims.
• Automatic timestamp conversion: the tool converts supported datetime input into JWT-friendly numeric values.
• HS256 signing: token signing uses HMAC-SHA256.
• Random secret generation: generate a strong 32-character secret key for testing.
• Copy-ready output and validation feedback: build the token and copy it from the result panel.

1. Fill in the standard claims such as issuer, subject, audience, and expiration time.
2. Add custom claims if needed by clicking Add Claim and entering the claim name and value.
3. Enter your signature key or generate a random secret for HS256 signing.
4. Click Build JWT to create the signed token.
5. Copy the generated token from the output panel and use it in your app or test flow.

This generator supports the standard claims defined by the JWT specification.

• iss (Issuer): identifies who issued the token.
• sub (Subject): identifies the principal the token refers to, often a user ID.
• aud (Audience): specifies the intended recipient such as an API or service.
• exp (Expiration Time): defines when the token becomes invalid.
• nbf (Not Before): defines the earliest time the token is valid.
• iat (Issued At): records when the token was issued.
• jti (JWT ID): provides a unique identifier for the token.

• Checks for missing required fields such as signing key, issuer, and expiration time.
• Validates supported datetime formats before token generation.
• Parses JSON-style custom claim values when possible and falls back safely to strings.
• Surfaces signature-generation failures without exposing sensitive values.
• Keeps the result area clear when generation fails so invalid output is not reused accidentally.

• Client-side only: no claim data or secrets are sent to a server.
• Web Crypto based signing: cryptographic operations use browser APIs.
• No secret storage: the signature key is used in memory only.
• Best for testing and development: avoid using production secrets in any browser tool.

The JWT Generator works in modern browsers that support:

• Web Crypto API
• TextEncoder API
• Clipboard support for copy actions
• ES6+ JavaScript features

• Frontend: Pure HTML, CSS, and JavaScript rendered through the CodeSamplez tool shell.
• Cryptography: Web Crypto API with HMAC-SHA256 signing.
• Encoding: Base64URL handling for JWT header, payload, and signature segments.
• Input processing: datetime parsing, JSON custom-claim parsing, and validation feedback.

Please get in touch with us for any bug report, feature request, or feedback about the JWT Generator.

Is this JWT generator free to use?

Yes. The CodeSamplez JWT Generator is completely free to use and runs directly in your browser.

Which algorithms does the JWT Generator support?

Right now this tool supports HMAC-SHA256 (HS256) for signing generated tokens.

Can I verify or decode a JWT here?

This page is focused on token creation. If you want to inspect or validate an existing token, use the CodeSamplez JWT Decoder tool.

Do JWTs expire?

They can. JWTs expire when you include the exp claim, and setting an expiration time is recommended for better security.

Is using an online JWT generator safe?

For testing and development, yes. This generator works locally in your browser so claims and signing keys are not sent to a server, but you should still avoid pasting production secrets or sensitive payloads into any online tool.