JWT Generator

Create signed JSON Web Tokens with HMAC-SHA256/384/512

{{ error }}

What is a JWT?

A JSON Web Token (JWT, RFC 7519) is a compact, signed container for JSON data. It has three Base64URL-encoded parts separated by dots: header (algorithm), payload (claims) and signature. JWTs are used for stateless API authentication (bearer tokens), OAuth/OpenID Connect and single sign-on.

Which algorithm?

HS256/384/512 are symmetric HMAC algorithms — sender and receiver share the same secret. Simple and fast, fitting for internal APIs. For public APIs, asymmetric RS256 or ES256 (public/private key) is preferred — both supported by Web Crypto API but with more complex key management. 'none' (unsigned) should never be used in production.

Important security notes

  • Never put secret data in the payload — JWTs are signed, not encrypted
  • Secret must be at least as long as the hash output (256/384/512 bits)
  • Always set exp/nbf claims and validate on receipt