Build and sign a JSON Web Token with HS256, HS384 or HS512, with one click iat, exp and nbf claims.
Only the HMAC algorithms are offered. RS256 and ES256 need a private key, which should never be pasted into a web page.
The signed token appears here
A JWT is signed, not encrypted. Anyone holding the token can read the payload, so never put a secret inside it.
HS256 covers almost every case. The secret is the same string your server uses to verify the token, so it needs to be long and random, not a word.
Standard claims like sub, iss and aud go alongside whatever your application needs. The buttons above the editor add iat, exp and nbf with the right epoch values.
The three coloured parts are the header, the payload and the signature. Paste the whole string into an Authorization header as Bearer and your API can verify it.
No, and this is the single most misunderstood thing about JWTs. The payload is Base64URL encoded, which anyone can decode in a second. The signature stops the token being modified, not read. Never put a password, a card number or anything private inside a JWT.
RS256 and ES256 sign with a private key. Pasting a production private key into a web page, any web page, is a leak waiting to happen. Sign asymmetric tokens with your own backend library instead.
They are Unix timestamps in seconds. iat is when the token was issued, exp is when it stops being valid, and nbf is a time before which it must be rejected. Short expiry is a real defence, because a stolen token is only useful until exp.
For an access token, minutes rather than days. Fifteen minutes with a refresh token behind it is a common pattern. A token that lives a month is a month long window for anyone who steals it, because there is no way to revoke a stateless JWT before it expires.
Use your language's JWT library with the same secret, and make sure it checks the algorithm too. The classic vulnerability is a server that trusts the alg field in the header and accepts a token signed with none.
Yes, with our JWT decoder, which reads the header and payload and shows the claim times in a readable form. It does not need the secret, because reading a JWT never does.
At least 32 random bytes. Generate one with our API key generator and store it in an environment variable, not in the repository. If the secret leaks, anyone can mint valid tokens for your API.
No. Signing runs inside this tab using the Web Crypto API. Nothing you type is sent anywhere or stored.
Online JWT decoder, no login required. Paste a JSON Web Token to inspect its header, payload and expiration. Decoding happens entirely in your browser.
Open ToolSign a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512. Hex and Base64 output.
Open ToolGenerate cryptographically random API keys and tokens in hex, Base64URL, Base62 or UUID v4, with an optional prefix.
Open Tool