ToolMight LogoToolMight

JWT Creator & Signer

Compose custom Header and Payload JSON claims, select symmetric (HS256/HS384/HS512) or asymmetric (RS256) algorithms, and sign JWT tokens client-side. Test authentication flows with complete data privacy.

Loading Tool...

Learn About This Tool

Understanding JSON Web Token (JWT) RFC 7519 Architecture

JSON Web Tokens (JWT) defined in RFC 7519 are an open, industry-standard method for representing claims securely between two parties. A JWT consists of three Base64Url-encoded segments separated by periods (.): the Header (defines algorithm and token type), the Payload (contains subject claims and expiration metadata), and the Signature (verifies payload integrity). To inspect or decode existing tokens, use our JWT Decoder.
// Compact JWT Token Structure:
// [Header Base64Url].[Payload Base64Url].[Signature Base64Url]

// Example Encoded Token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3...
  • Header segment: Declares algorithm (`alg`) and media type (`typ: "JWT"`) metadata
  • Payload segment: Contains standard claims (`sub`, `iss`, `aud`, `exp`, `iat`) and custom user claims
  • Signature segment: Prevents payload tampering using secret keys or RSA private keys
  • URL-safe Base64Url encoding makes tokens ideal for HTTP `Authorization: Bearer` headers

Symmetric (HMAC) vs Asymmetric (RSA) Signing Algorithms

Selecting the appropriate signing algorithm depends on your API infrastructure. Symmetric algorithms (HS256, HS384, HS512) use a shared secret key string for both token generation and verification. Asymmetric algorithms (RS256) use a private key PEM string to sign tokens and a public key to verify signatures. You can generate RSA key pairs using our RSA Key Generator.
  • HS256 (HMAC-SHA256): Fast symmetric signing for single-service backend architectures
  • RS256 (RSA-SHA256): Asymmetric signing for OAuth2 providers and decoupled microservices
  • RS256 requires PKCS#8 unencrypted Private Key PEM strings
  • All signing calculations process client-side via native Web Cryptography APIs

Standard Registered Claims & Expiration Timestamps

RFC 7519 defines several standard registered claim names to ensure interoperability across auth servers. The `exp` (expiration time) and `nbf` (not before) claims use numeric Unix Epoch timestamps (seconds since Jan 1, 1970). Including an expiration claim prevents stolen tokens from being reused indefinitely.
  • `sub` (Subject): Identifies the principal user ID or account UUID
  • `exp` (Expiration Time): Unix timestamp defining token validity boundary
  • `iat` (Issued At): Unix timestamp recording when the token was created
  • `iss` (Issuer): String identifying the issuing authentication server

100% Client-Side Private Token Signing

Pasting secret keys or production signing passphrases into remote token generation sites poses serious security risks. This tool executes 100% locally in your browser memory using the Web Cryptography API. Zero secret keys, payloads, or generated tokens leave your device.
  • Local Web Cryptography API execution protects signing secrets
  • No logging, tracking, or network transmission of authentication tokens
  • Instant real-time token compilation without server delay
  • Supports dark mode and works offline as a PWA

How to Use JWT Creator & Signer

1

Select Algorithm & Configure Header

Choose your signing algorithm (HS256, HS384, HS512, or RS256) and edit the Header JSON schema in the left panel.

2

Input Payload Claims & Secret Key

Modify the Payload JSON claims (setting `sub`, `exp`, and custom properties), and input your secret key passphrase or RSA Private Key PEM string.

3

Sign & Copy Token

Click `Generate Token` to compute the cryptographic signature. Copy the color-coded token for use in your API testing.

Code Implementations

Copy & paste production-ready code snippets for JWT Creator & Signer in your language of choice

File: jwt_signer.py
Python
import jwt

payload = {
    "sub": "1234567890",
    "name": "Alex",
    "admin": True
}
secret = "your-256-bit-secret-key"

token = jwt.encode(payload, secret, algorithm="HS256")
print("Signed JWT:", token)

Frequently Asked Questions

JWTs are signed and Base64Url-encoded, not encrypted. The header and payload claims are readable by anyone who inspects the token string. Do not store sensitive secrets (like passwords or credit card numbers) in JWT payloads.
Standard registered claims include `sub` (user ID), `iat` (issued-at timestamp), `exp` (expiration timestamp), `iss` (issuer URL), and `aud` (audience).
The tool imports your passphrase or RSA private key locally using the browser's Web Cryptography API (`window.crypto.subtle`) and signs the `header.payload` string.
RS256 mode requires an unencrypted PKCS#8 Private Key PEM string starting with `-----BEGIN PRIVATE KEY-----` and ending with `-----END PRIVATE KEY-----`.
Yes! Copy the generated dot-separated string and pass it in your HTTP request headers as `Authorization: Bearer <your_token>`.
Yes. All signing calculations execute 100% locally in your browser's JavaScript runtime. No keys or token payloads are sent to external servers.
HS256 uses a single symmetric secret key for both signing and verification. RS256 uses an asymmetric private key for signing and a public key for verification.
JWT headers and payloads must be written as valid JSON. Ensure keys and string values use double quotes, and check for missing brackets or trailing commas.
JWT timestamps (`exp`, `iat`, `nbf`) use Unix Epoch timestamps (seconds since Jan 1, 1970). You can use our example payload button to populate current timestamps automatically.
Yes! You can add custom key-value pairs (such as `"role": "admin"` or `"email": "[email protected]"`) to the payload JSON object.
In JavaScript, set `exp` to `Math.floor(Date.now() / 1000) + 3600`. The tool provides sample preset buttons to set expiration offsets easily.
If any character in the header or payload is altered, the signature check on the backend server will fail, rejecting the request as untrusted.
Yes. Copy the generated token string and open our JWT Decoder tool to inspect the decoded header and payload claims.
Press `Ctrl+L` (or `Cmd+L` on Mac) to reset the editor inputs instantly.

Related tools

RSA Key Generator

New

Build secure RSA public and private key pairs.

Password Generator

New

Create strong random passwords and check strength.

UUID Generator

Popular

Generate secure bulk v1, v4, and v7 UUIDs.

Hash Generator

Popular

Create secure MD5, SHA-256, and SHA-512 hashes.

Deep Dives & Guides

Master this tool with our expert tutorials and best practices.

3 min readArticle

Demystifying JWT Authentication, Refresh Tokens & Key Rotation Strategies

A deep dive into JSON Web Tokens (RFC 7519), token structure, signature verification, XSS/CSRF mitigation, and production refresh token key rotation architectures.

Read Full Guide