JWT Creator & Signer

Compose custom header/payload schemas and sign them with HMAC secrets or RSA private key PEMs client-side.

Signature Algorithm:

Header JSON (Type & Algorithm)

Payload JSON (Claims / Data)

HMAC Signature Key

Generated JSON Web Token

Token will display here...

Loading Tool...

Learn About This Tool

Understanding JSON Web Tokens (JWT) Architecture

JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims to be transferred between two parties. A JWT is composed of three parts separated by dots (.): the **Header** (defines token metadata and algorithm), the **Payload** (contains JSON claims like user IDs and permissions), and the **Signature** (verifies that the sender is who they claim to be). To inspect incoming tokens, check out our JWT Decoder. Here is the typical formatted token layout:

// Base64UrlEncoded format:
header_base64.payload_base64.signature_base64

// Example encoded JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3...

Header defines typ (JWT) and alg (HS256, RS256, etc.) properties
Payload claims contain expiration timestamps (exp) and user metadata
Signature ensures the payload was not tampered with during transit
URL-safe encoding format makes tokens ideal for HTTP authorization headers

Symmetric vs Asymmetric Signing (HMAC vs RSA)

This signer supports both symmetric HMAC algorithms (HS256, HS384, HS512) and asymmetric RSA algorithms (RS256). Symmetric signing uses a single shared secret key string. Asymmetric signing uses an RSA Private Key PEM string to sign, which you can easily generate using our RSA Key Generator. Validation is performed using the corresponding public key.

HS256 is ideal for single-service backend verification keys
RS256 is recommended for microservices or third-party auth integrations
RSA private keys must be in PKCS#8 unencrypted PEM formats
All signing calculations are processed client-side via Web Crypto Subtle API

Visual Token Breakdown and Segment Highlights

Our premium layout color-codes the generated token segments to match their JSON schemas. The Header segment is highlighted in **rose/red**, the Payload segment in **sky/blue**, and the Signature segment in **amber/orange**. This visual breakdown helps you inspect token anatomy instantly.

Color-coded highlights match standard debugger layouts
Live syntax checkers validate JSON structures before compiling
Automatic expiration timestamp calculations simplify token setups
Copy buttons capture the complete dot-separated string instantly

How to Use JWT Creator & Signer

Configure Token Metadata

Select the signing algorithm (HS256 or RS256) and edit the Header JSON schema in the left column.

Input Claims Payload & Secret Key

Edit the Payload JSON values (adding standard claims like sub, iat, exp) and provide the signing secret key or PEM string.

Copy the JWT Token

Click Generate to sign. The color-coded JWT will appear on the right side. Copy the token for authorization headers.

Common questions

What is the difference between JWT encoding and encryption?

JWTs are encoded using Base64Url, which is easily reversible and visible to anyone. They are signed, not encrypted. Do not store sensitive secrets (like passwords) inside the payload.

What are the standard claims inside a JWT Payload?

Common claims include sub (subject/user ID), iat (issued-at timestamp), exp (expiration timestamp), iss (issuer), and aud (audience).

How does the browser verify signature integrity?

The tool imports your passphrase or RSA private key locally using Web Crypto Subtle APIs and signs the header.payload inputs to verify it matches the generated signature block.

Which RSA key format is required for RS256?

The tool requires a PKCS#8 Private Key PEM string. It begins with '-----BEGIN PRIVATE KEY-----' and ends with '-----END PRIVATE KEY-----'.

Can I use this generated token in my authorization header?

Yes, you can copy the resulting token and use it as a Bearer token in your client headers (e.g. 'Authorization: Bearer <your_token>').

Is my private signing key secure inside this tool?

Yes. All signing calculations are performed 100% locally in your browser's JavaScript runtime. No keys or payloads are sent to any external server.

What is the difference between HS256 and RS256?

HS256 is a symmetric signing algorithm, meaning the same secret key is used to both sign and verify the token. RS256 is an asymmetric signing algorithm, which uses a private key to sign the token and a public key to verify it.

Why does the tool show JSON validation errors?

JWT headers and payloads must be written in valid JSON format. Ensure all property keys and string values use double quotes, and check for missing colons, braces, or trailing commas.

How are the timestamps in the payload calculated?

JWT timestamps (like `iat` for issued-at, `nbf` for not-before, and `exp` for expiration) are expressed as Unix Epoch timestamps (the number of seconds since January 1, 1970). You can use our standard example to set these timestamps automatically.

Can I add custom claims to the payload?

Yes. You can add any custom key-value pairs (like user roles, departments, or custom preferences) to the payload JSON object before generating the token, as long as it remains a valid JSON structure.