JWT Generator

What is a JWT Generator?

A JWT Generator builds a signed JSON Web Token from three parts you control: a header that declares the signing algorithm, a payload with your claims, and a secret. The token is formed as header.payload.signature, where the signature proves the first two parts have not been altered since signing.

How is the token assembled?

• Header: small JSON declaring the algorithm (for example HS256), base64url-encoded without padding.
• Payload: the claims — JSON such as issuer, subject and expiry, also base64url-encoded.
• Signature: the HMAC-SHA256 digest of header.payload, keyed with your secret.
• The final token is header.payload.signature, ready to copy into a test, curl command or another service.

What role does the secret play?

The secret is the private key that signs the token. The server that issues and verifies the token keeps the same secret. Anyone with the secret can forge tokens, so treat it like a password — never put it in client-side code or a public repository.

When should you use a JWT?

• Stateless authentication: the server verifies a signature instead of storing sessions.
• API access: short-lived access tokens in Authorization headers.
• Single sign-on between applications that share a signing secret.
• Remember: JWTs are signed, not encrypted — never put passwords or personal data in the payload unless you add an extra layer of encryption.

How to use the FreetoolsY generator

Paste your header and payload JSON, type your secret and press generate. You get the complete token plus the three parts shown separately, with a copy button for the result. Everything is signed in your browser with the Web Crypto API — no part of the token or your secret ever leaves the page.