How to create a JWT
- Choose the signing algorithm. The header's "alg" follows your choice.
- Edit the payload claims. Use the time helpers to set iat, nbf, exp, or a random jti.
- Enter the secret, or for RS256 and ES256 paste a PKCS#8 private key or generate a test key pair.
- Copy the signed token from the right. It updates as you type.
To read an existing token instead, use the JWT Decoder. Need a random secret to sign with? The Password Generator makes long random strings.
Questions
Are my secret and private key sent anywhere?
No. The token is signed with your browser's built-in Web Crypto API and the page makes no network requests with your data. Still, use test secrets here. Never paste the signing key of a live production system into any website.
Which algorithms are supported?
HS256, HS384, and HS512 (a shared secret), RS256 (an RSA private key), and ES256 (a P-256 elliptic-curve private key). For RS256 and ES256, paste an unencrypted PKCS#8 key or let the tool generate a test key pair.
My key starts with BEGIN RSA PRIVATE KEY. Why is it rejected?
That is the older PKCS#1 format, and browsers only import PKCS#8. Convert it with: openssl pkcs8 -topk8 -nocrypt -in key.pem -out pkcs8.pem. EC keys that start with BEGIN EC PRIVATE KEY need the same conversion.
How do exp, iat, and nbf work?
They are Unix timestamps in seconds. iat is when the token was issued, nbf is the earliest time it is valid, and exp is when it expires. The time helpers fill them in from the current time, and the dates are shown under the payload.
How can I check the token I made?
Paste it into the JWT Decoder to read the header and payload and check an HMAC signature. For RS256 and ES256, verify it with the public key shown next to the private key.
Credits
Built by OneTooling using standard browser features. No third-party code runs on your data.