Is the JWT Generator free to use?

Yes, completely free. No signup, no API key, no usage limits. The JWT Generator runs entirely in your browser using the Web Crypto API for HMAC signing — you can generate as many tokens as you need without any cost or restrictions.

Does the JWT Generator store my secret or tokens?

No. All JWT generation happens locally in your browser. Your secret key, header, payload, and generated tokens never leave your device or get sent to any server. This makes the tool safe to use even with sensitive signing keys. Once you close or refresh the page, all data is gone.

Which JWT algorithms does the JWT Generator support?

The tool supports all three HMAC-SHA algorithms: HS256 (HMAC with SHA-256), HS384 (HMAC with SHA-384), and HS512 (HMAC with SHA-512). These are symmetric algorithms, meaning the same secret is used for both signing and verification. RSA and ECDSA algorithms (RS256, ES256, etc.) are not supported because they require asymmetric private/public key pairs.

What is the difference between HS256, HS384, and HS512?

The number after "HS" refers to the SHA hash function used: HS256 uses SHA-256 (256-bit output), HS384 uses SHA-384 (384-bit output), and HS512 uses SHA-512 (512-bit output). Higher numbers provide stronger security but produce longer signatures. HS256 is the most commonly used and is sufficient for most applications. HS512 is recommended for high-security scenarios.

What claims should I include in my JWT payload?

At minimum, include the "iat" (issued at) and "exp" (expiration time) claims. "iss" (issuer) and "aud" (audience) help prevent token reuse across different services. "sub" (subject) identifies the user or entity. You should also include any custom claims your application needs, such as "role", "permissions", or "email". Avoid including sensitive data like passwords or credit card numbers — JWT payloads are not encrypted.

How long should a JWT be valid for?

For access tokens, a short expiration of 15 minutes to 1 hour is recommended. JWTs are stateless and cannot be easily revoked before expiration, so shorter lifetimes limit the damage if a token is compromised. For longer sessions, use a refresh token (with its own expiration) to obtain new access tokens without requiring the user to re-authenticate.

Can I use the generated JWT in my production application?

Yes, the JWTs generated by this tool are real, cryptographically signed tokens that comply with RFC 7519. However, you should use a unique, strong secret key for production — not the example secret provided by the tool. For production systems, consider using a dedicated JWT library in your backend (such as jsonwebtoken for Node.js or PyJWT for Python) for key management and automatic rotation.

Are JWTs encrypted? Can someone read my token contents?

No, standard JWTs (JWS) are not encrypted. The header and payload are base64url-encoded, which is reversible by anyone who has the token. Think of a JWT as a signed postcard — the message is readable by anyone, and the signature proves authenticity. If you need the payload to be confidential, use JWE (JSON Web Encryption) tokens instead, which encrypt the payload.

🛠️DevToolsHub

JWT Generator

Generate JWT tokens with custom header and payload.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format defined by RFC 7519. It is widely used in modern web applications for authentication, authorization, and secure information exchange between parties. A JWT encodes a set of claims as a JSON object and signs them cryptographically, ensuring the token’s integrity can be verified by anyone who holds the signing key.

JWTs are used everywhere — from OAuth 2.0 access tokens and OpenID Connect ID tokens to API authentication, single sign-on (SSO) systems, and microservice-to-microservice communication. They are popular because they are stateless: the server can verify a token without a database lookup, reducing latency and infrastructure complexity. However, this statelessness also means JWTs cannot be easily revoked before their expiration, making proper claim design and key management critical.

How to Generate JWT Tokens

Generating a JWT involves three steps: creating the header, creating the payload, and signing the token with a secret key. DevToolsHub’s JWT Generator handles all three steps in your browser — no server round-trips, no data leaving your device.

Choose a signing algorithm. This tool supports HMAC-SHA algorithms: HS256, HS384, and HS512. HS256 is the most common choice and provides a good balance of performance and security for most applications.
Configure the header. The header is a JSON object with two required fields: alg (the algorithm) and typ (the token type, typically "JWT"). The algorithm field is updated automatically when you change the dropdown selection.
Define the payload. The payload contains your claims — statements about the entity (typically a user) and additional metadata. Use the quick-fill buttons to set common expiration times (1 hour, 7 days, 30 days) automatically.
Enter your secret key. The secret is used to compute the HMAC signature. Use a strong, randomly generated key in production. Never share or expose your secret.
Click “Generate JWT” to produce the token. The generated token appears below with a copy button and a link to decode it in our JWT Decoder.

JWT Structure Explained

A JWT consists of three base64url-encoded segments separated by dots:header.payload.signature. Each segment serves a distinct purpose in the token’s structure.

Header

The header is a JSON object that identifies the token type and the cryptographic algorithm used to sign it. The two required fields are alg, which specifies the signing algorithm (e.g., HS256, HS384, HS512), and typ, which is always set to "JWT". The header may also include a kid (key ID) field to help verifiers select the correct key in multi-key environments.

Payload

The payload contains claims — statements about an entity and additional metadata. The JWT specification defines seven registered claims: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). You can also include custom private claims such as role,name, or permissions to suit your application’s needs.

Signature

The signature is created by taking the base64url-encoded header and payload, joining them with a dot, and computing the HMAC of the resulting string using the secret key. The signature ensures that any modification to the header or payload will invalidate the token. When the recipient verifies the JWT, they recompute the signature using the shared secret and compare it to the one in the token. This tool uses the Web Crypto API to perform HMAC signing directly in your browser, ensuring your secret never leaves your device.

Security Best Practices

Use strong secrets. Generate secrets using a cryptographically secure random generator. A minimum of 256 bits (32 bytes) is recommended for HS256. Avoid using passwords, short strings, or predictable values as signing keys.
Set short expiration times. JWTs are stateless and cannot be revoked easily. Set a short exp claim (15 minutes to 1 hour for access tokens) and use refresh tokens for long-lived sessions.
Always use HTTPS. JWTs are bearer tokens — whoever possesses one can use it. Transmit tokens only over encrypted HTTPS connections to prevent interception.
Never store JWTs in localStorage. Browser localStorage is accessible to any JavaScript running on the page, making it vulnerable to XSS attacks. Use HttpOnly cookies for server-side apps or in-memory storage for SPAs.
Do not put sensitive data in the payload. JWTs are encoded, not encrypted. Anyone who intercepts the token can read its full contents. If you need confidentiality, use JWE (JSON Web Encryption) tokens instead.
Validate tokens on the server. Always verify the signature, check the exp and nbf claims, and confirm the iss and aud claims match expected values before trusting any JWT.
Rotate keys regularly. Change your signing secret periodically and use key rotation strategies in production to minimize the impact of a compromised key.

Frequently Asked Questions