JWT Generator

How to use the JWT generator

Generate JWTs for local testing, debugging auth flows, or generating signed payloads in scripts. Set custom claims, pick HMAC-SHA256 signing, and copy the token. This generator is for development only — don't use the output as production secrets, and never paste real production keys here.

• 1. Pick the algorithm. HS256 (HMAC) is symmetric — same secret to sign and verify. RS256/ES256 are asymmetric — sign with private key, verify with public.
• 2. Set the header. typ: JWT, alg as picked. Add kid if your verifier rotates keys.
• 3. Build the payload. Standard claims: iss (issuer), sub (user ID), aud (audience), exp (expiration — Unix seconds), iat (issued at), nbf (not before). Custom claims go alongside.
• 4. Enter the signing secret (HS256) or paste the private key (RS256/ES256). Use a 256-bit random secret for HMAC; never reuse short or predictable values.
• 5. Copy the resulting JWT (three Base64URL-encoded parts: header.payload.signature). Verify with the matching key in your auth server's JWT library.

Common mistakes to avoid

• Using alg: none in production. Accepting unsigned tokens lets anyone forge any identity. Always whitelist allowed algorithms server-side.
• HS256 with a weak secret. Anything under 32 random bytes is brute-forceable. Use 256-bit random keys, or switch to RS256/ES256.
• Forgetting exp. Tokens without expiration live forever — a leaked token is permanent compromise. Set short exp (5–60 min) and rotate refresh tokens.
• Storing secrets inside the JWT payload. Bodies are Base64-encoded, not encrypted. Use JWE (encrypted JWT) for sensitive claims, or store server-side and reference by ID.
• Not validating iss and aud on the server. A token signed for service A can be replayed against service B if the secret is shared and audience isn't checked.
• Pasting production private keys into online tools. Even tools that swear they're client-only — verify the network tab. For real keys, use server-side libraries (jsonwebtoken, PyJWT, Auth0).