Easily construct and encode custom JSON Web Tokens (JWT). Add custom claims to the
payload, select your algorithm, and sign the token directly in your browser.
Try:
JWT Token
Paste a JWT or click a sample above
Token Structure
HeaderPayloadSignature
Header
Payload
⚠ alg: none detected — This token has no signature. Some vulnerable JWT libraries accept
unsigned tokens, which allows attackers to forge arbitrary claims. Never accept alg: none in
production.
Claims
Generated Token
Fill in the fields to generate a token
HeaderPayloadSignature
Awaiting input…
Encoded Payload Preview
Algorithm
Secret (HMAC signing key)
Standard Claims
sub subject — user ID or entity
iss issuer — who created this token
aud audience — intended recipient
Expiry relative from now
Custom Claims
Token to Verify
Secret / Key
Algorithm
HMAC Secret
Advertisement
Decode
Paste any JWT to inspect its header, payload, and claims. Standard claims like
exp, iat, sub are explained in plain English. Expiry shown as a live
countdown. alg:none is flagged as a critical security risk.
Build
Construct a valid signed JWT. Set algorithm, secret, standard claims (sub, iss, aud,
exp), and add custom claims. Token generates live as you type. Copy and paste directly into your API client
or test fixture.
Verify
Paste a token and your HMAC secret to verify the signature. Uses the browser's native
Web Crypto API — nothing is sent to a server. Supports HS256, HS384, HS512.
Samples
Five preloaded tokens: Standard auth, OAuth access token with scopes, Firebase-style, an
expired token to see how it looks, and an alg:none token demonstrating the attack vector.
Security Note
JWT payloads are not encrypted — only Base64-encoded. Anyone can decode
and read them. Never put passwords, credit card numbers, or secrets in a JWT payload.
Claim Reference
sub subject · iss issuer · aud audience ·
exp expiry · iat issued at · nbf not before · jti token
ID. Defined in RFC 7519.
Advertisement
How to use
Open the tool and enter your data or select options.
Adjust settings to see real-time updates.
Copy the generated result to your clipboard.
Frequently Asked Questions
What is a JWT?
A
JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties.
They are commonly used for authentication.
Is the secret key secure?
Yes,
because this tool runs entirely locally in your browser, the secret key you use to sign the token is never
transmitted over the internet.
Does this validate tokens?
This
tool is primarily for building tokens. To decode and validate existing tokens, use our JWT Decoder tool.
Did you know?
A JWT consists of three parts separated by dots: the Header, the Payload, and the Signature.
The payload of a JWT is only Base64 encoded, not encrypted. Anyone who intercepts the token can read the data
inside it.
The 'alg' header parameter 'none' was a notorious vulnerability in early JWT libraries that allowed attackers
to bypass signature verification.