JWT Builder

Build JSON Web Tokens from scratch — set header, payload claims, algorithm and secret.

Loading ratings...

Rate this tool

Quick Answer

A JSON Web Token is a compact, URL-safe token containing a header, payload and signature that can be verified to authenticate requests between parties.

What Is JWT Builder?

JWT Builder is a free online security tools tool that build json web tokens from scratch — set header, payload claims, algorithm and secret. A JWT (JSON Web Token) builder lets you construct a signed JWT by specifying the header, payload, and secret key. JWTs are used in modern web authentication (OAuth 2.0, OpenID Connect) to pass identity information between parties as a compact, URL-safe token. The builder takes your header (typically {"alg": "HS256", "typ": "JWT"}) and payload (custom claims like "sub", "name", "iat", "exp"), signs them with HMAC-SHA256 using your secret, and outputs the three-part dot-separated token. It also validates tokens you paste — decoding the header and payload and checking the signature. This is useful for developers implementing or debugging JWT-based authentication flows. Everything runs client-side. Unlike many similar tools, it runs entirely in your browser — no data is sent to any server, no account is required, and there are no usage limits. Whether you are a developer, writer, SEO professional, or casual user, this tool provides instant, accurate results without friction.

jwt buildercreate jwtjwt generatorjwt makerjson web token builderjwt token creatorcustom jwt

How to Use JWT Builder

Edit the header and payload JSON, enter a secret key, and click Build to generate a signed JWT. To validate, paste a JWT and secret to decode and verify the signature.

Key Features

Build JWTs with custom header, payload, and secret
Validate/decode existing JWTs
Automatic expiration (iat/exp) helpers
Fully client-side

Common Use Cases

Testing JWT implementation during API development
Generating a token for integration testing
Debugging a JWT that does not validate on the server side

Common Mistakes to Avoid

Using a weak secret that can be brute-forced to forge tokens
Storing sensitive claims (like passwords) in the payload — JWT payload is base64-encoded, not encrypted
Forgetting to set an expiration (exp) claim, creating a token that never expires

Common Questions About JWT Builder

Is a JWT encrypted?

The header and payload are base64-encoded, not encrypted. Anyone can decode them. Do not store sensitive information in a JWT payload.

What algorithm should I use?

HS256 (HMAC with SHA-256) is the most common for symmetric signing. For production, consider RS256 with a public/private key pair.

Related Tools & Resources

JWT Decoder
HMAC Generator
Hash Generator

Best Practices for JWT Builder

To get the most out of JWT Builder, follow these best practices. Ensure your input data is clean and properly formatted for the most accurate results. Use the copy function to transfer output directly to your clipboard. Bookmark the tool for easy access. Check the related tools section below for complementary utilities that can enhance your workflow. Remember that all processing is client-side, so your data never leaves your browser.

More Security & Validation Tools

JWT Builder is part of the Security & Validation Tools topic. Explore related tools in this cluster:

Privacy & Security

JWT Builder processes all data entirely within your browser using JavaScript. No text, files, or personal information is transmitted to any server. Your data stays on your device, making this tool safe for sensitive content. We do not track usage, store inputs, or share data with third parties. The tool works offline after the initial page load and requires no account to use.

Frequently Asked Questions

Find answers to common questions about this tool.

How do I build a JWT?

Enter the header (algorithm, type), payload (claims like sub, exp, iat), and secret key. The JWT Builder encodes the header and payload as Base64 and signs them with your key.

What claims should I include in a JWT?

Standard claims include sub (subject), exp (expiration time), iat (issued at), iss (issuer), and aud (audience). Custom claims can also be added for your application.

Which signing algorithm should I use?

HS256 (HMAC with SHA-256) is simplest for single-service apps. RS256 (RSA) is better for multi-service architectures as it uses public and private key pairs.

How do I set an expiration time in the JWT payload?

Add an "exp" claim with a Unix timestamp in seconds. For example, Math.floor(Date.now() / 1000) plus 3600 expires the token in one hour. The JWT Builder accepts numeric timestamps.

Does the builder validate the token after generating it?

Yes. The generated token is validated by decoding it and checking the signature. A green indicator shows the token is valid. Copy the token directly into your API configuration.

Resources

Topic Cluster

JWT builder, API key generator, credit card validator, and random number generator for application security and data validation.

Browse all Security & Validation Tools

4 tools in this topic

About Testrefy

All tools run entirely in your browser. No data is sent to any server. 100% private and free.

Browse all tools