JWT Generator (HS256, HS384, HS512)

What is JWT Generator?

A JWT (JSON Web Token) is a compact, URL-safe token that carries signed claims between parties. This generator builds and signs tokens with HMAC-SHA algorithms (HS256, HS384, HS512): you provide the claims and a shared secret, and it produces the three dot-separated Base64URL segments — header, payload, and signature. It's ideal for creating test tokens for local development, API testing, and learning how JWTs are structured.

How to generate a signed JWT

1. 1Choose an algorithm (HS256 is the common default).
2. 2Edit the payload to include your claims — sub, exp, iat, and any custom fields.
3. 3Enter your signing secret (a shared string for HMAC algorithms).
4. 4Copy the generated token and use it as a Bearer token in Authorization headers.

Use Cases

Code Examples

{
  "sub": "1234567890",
  "name": "Ada",
  "iat": 1516239022,
  "exp": 1516242622
}

header.payload.signature

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.SIGNATURE

Key Concepts

Registered claims

Standard fields: iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued-at), nbf (not-before). Use them for interoperability.

HMAC vs RSA/ECDSA

HS256/384/512 use one shared secret for both signing and verification. RS256/ES256 use a private/public key pair — better when many parties must verify but not sign.

exp (expiration)

A Unix timestamp after which the token is invalid. Always set a short exp for access tokens to limit blast radius if leaked.

Tips & Best Practices

• ▸Use secrets of at least 32 bytes for HS256, 48 for HS384, and 64 for HS512 — shorter secrets weaken the signature.
• ▸Never put sensitive data in the payload: it's Base64URL-encoded, not encrypted, and anyone can read it.
• ▸Always set exp. Tokens without expiry are a common security finding.
• ▸Generate test tokens only with throwaway secrets — never paste production signing keys into any web tool.