Softonic

JWT Generator

Step 1 / 2 Generate JWT
Next

Build and sign a JWT right in your browser. Enter the payload claims (standard sub, aud, exp, etc. plus anything custom), pick the algorithm (HS256 with a shared secret or RS256/ES256 with a private key) and the tool produces the three-part token. Useful for local development, load testing and reproducing authentication issues.

How to generate a JWT

  1. 1

    Write the payload

    Standard claims (`sub`, `iss`, `aud`, `exp`, `iat`, `nbf`) plus any custom ones your app expects.

  2. 2

    Pick the algorithm

    HS256/384/512 with a shared secret, or RS256/ES256 with a private key in PEM format.

  3. 3

    Provide the key

    Shared secret text for HMAC, or paste the private key for RSA/ECDSA. Both stay in your browser.

  4. 4

    Generate

    Output is the signed token. Copy it, use it in tests, decode it with the JWT Decoder to inspect.

Typical payload for an authenticated user token

{
  "iss": "https://auth.example.com",
  "aud": "api.example.com",
  "sub": "user_12345",
  "iat": 1713398400,
  "nbf": 1713398400,
  "exp": 1713402000,
  "jti": "3c7c7e14-2de4-41f0-bf09-1eb5cfad4c01",
  "scope": "read:profile write:posts"
}

Algorithm choice: HMAC vs asymmetric

Algorithm Key type Use when
HS256 256-bit shared secret Monolith that signs and verifies itself
HS384/512 Longer secret Same as HS256, stronger
RS256 RSA 2048+ Issuer signs, many services verify with public key
ES256 ECDSA P-256 Same as RS256 but smaller signatures
EdDSA Ed25519 Fastest asymmetric verification, smallest keys

Key strength

  • HMAC secrets must have at least as much entropy as the algorithm’s output size. HS256 needs 256 random bits (32 bytes); less is brute-forceable.
  • RSA keys should be 2048 bits minimum; 3072 or 4096 for long-lived tokens.
  • ECDSA (ES256) offers comparable security to RSA 3072 with much smaller keys and faster signing.

Expiry guidelines

Token type Typical exp duration
Access token 5 - 60 minutes
Refresh token Days to weeks
Password reset 5 - 15 minutes
Email verification 24 hours
Service-to-service 1-5 minutes (short)

Short expiry + refresh token is the modern pattern. Long-lived access tokens are hard to revoke when compromised.

Common mistakes

  • Reusing a test secret in production. The generator marks HS256 secrets and the output JWT as test-only if the secret looks weak. Trust that warning.
  • Signing without exp. A JWT without expiry is valid forever. Always set exp unless you have a very good reason and a revocation list.
  • Using the alg from the header on the verifier. Always whitelist algorithms on the verify side; do not follow what the token asks for.
  • Pasting a real private key here. This generator runs in your browser but treat private keys as secrets: use test keys, not production ones.

Frequently Asked Questions

No. Signing happens in your browser using the Web Crypto API. Keys never leave your machine. That said, for production keys, generate and sign in a controlled environment, not in a browser.

HS256 is fine for a monolith where the same service signs and verifies. RS256 or ES256 is better when the issuer is separate from the verifier, public keys can be shared without exposing the signing key.

Short. 5-15 minutes for access tokens is typical. Use a refresh token with a longer lifetime for seamless UX. Never issue JWTs without an exp claim.

The tool supports emitting alg: none for deliberate testing of broken / unsigned tokens, with a prominent warning. Never accept such tokens in production code.

Related Tools

A1Z26 Cipher Encoder

Encode text using the A1Z26 cipher (A=1, B=2, ... Z=26) or decode a number sequence back to letters, with customizable separator.

Cipher Identifier

Paste ciphertext and the identifier suggests likely encoding/cipher schemes: Base64, hex, binary, Morse, Caesar or substitution, JWT and common hashes.

Atbash Cipher Encoder

Encode or decode text with the Atbash cipher, a Hebrew substitution that maps A-Z to Z-A. Same operation encrypts and decrypts.

Checksum Verifier

Compute the MD5, SHA-1, SHA-256, SHA-384, SHA-512 or CRC32 checksum of any text and compare it with an expected value for a clear match or mismatch verdict.

Base64 File Encoder

Encode any file (PDF, ZIP, image, executable) to Base64 text for embedding in JSON, email, YAML or data URIs. Runs locally, no upload.

Caesar Cipher Encoder

Encrypt and decrypt text using the Caesar cipher. Any shift 1-25, supports ROT13 as a special case, preserves punctuation and case.

Tool available in other languages