JWT Generator - Create Signed JSON Web Tokens Online

Loading tool…

Free Online JWT Generator

JSON Web Tokens are the standard way to pass identity and claims between services. QodeCat JWT Generator lets you build a token from a JSON payload, pick an HMAC algorithm and sign it with your secret. It is ideal for testing APIs, mocking authentication in development and learning how JWTs are put together.

HMAC signing: Create tokens with HS256, HS384 or HS512.
Quick claims: Add iat, exp, nbf, sub and iss with one click.
Random secrets: Generate a strong secret with your browser's secure random generator.
Color-coded output: See the header, payload and signature parts at a glance.

How it works

Header, payload, signature

A JWT has three parts separated by dots. The header and payload are JSON encoded as base64url, and the signature is an HMAC of those two parts using your secret. Anyone with the same secret can verify that the token was not changed.

Your secret stays on your device

Signing uses the Web Crypto API built into your browser. Your payload and secret are never sent anywhere. Still, use test secrets here rather than production keys whenever you can.

Frequently Asked Questions

Q. Is the JWT payload encrypted?

No. The payload is only base64url-encoded, so anyone can read it. The signature prevents tampering, not reading. Never put passwords or other secrets in the payload.

Q. How long should my HMAC secret be?

At least as long as the hash output: 256 bits (32 bytes) for HS256, 384 bits for HS384 and 512 bits for HS512. The random secret button creates a key of the right size.

Q. Can I check a token I generated?

Yes. Paste it into the QodeCat JWT Decoder to inspect the header and payload and check its expiration time.