ā All Tools
JWT Builder Formatterš 100% local
Build JWT tokens. Privacy-first, no server uploads, no tracking.
Give it a claims object and it returns a finished HS256 token. Line 1 is your claims JSON, line 2 an optional secret; if the claims have no iat or exp, the builder stamps iat with the current second and sets exp an hour later. The header and the signature are then assembled right there in the page with a hand-written SHA-256 and HMAC-SHA256, and the token, header, claims and secret status come back in one block.
How to use it
- Paste your claims JSON on the first line, for example {"sub":"123","role":"admin"}.
- Put your signing secret on the second line. Skip it and the builder falls back to the placeholder change-me-in-production.
- Press Process, then copy the token line, or the header and claims breakdown if you want to check what went into it.
Worked example
{"sub":"123","iat":1700000000,"exp":1700003600}
my-secretbecomes=== JWT (HS256) ===
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDAwMzYwMH0.gHQvEhIJpWmwpXawyx3G2PyXbR7FbgO8C9z9L-iokbg
Header: {"alg":"HS256","typ":"JWT"}
Claims: {"sub":"123","iat":1700000000,"exp":1700003600}
Secret: (yours, not stored)
ā iat set to now, exp = now + 1h (override with your own claims).
ā In production: sign server-side, keep secrets out of client code, use short exp + refresh tokens.iat and exp are supplied in the input here, so the signature comes out the same on every run. Leave them out and the builder writes the current time and a one-hour expiry, which makes each token different.
When to use it
- Checking what a token your backend will accept actually looks like before you write the signing code.
- Producing a fixed token for a local mock server or a Postman collection that rejects requests without one.
- Showing someone how header, claims and signature fit together, with a real token in front of them instead of a diagram.
What it does not do
- A token signed with a secret you typed into a web page is only as private as that secret, and both are sitting in this tab and your clipboard. Use a throwaway value for testing, never a production signing key.
- Only HS256 is supported, and typ is hardcoded to JWT. There is no field for a different algorithm and no way to change the header.
- The secret is read from line 2 only when that line does not begin with a brace, so a second JSON object there is quietly treated as no secret at all.
- This page signs tokens. It does not verify them, check expiry against a clock, or tell you whether a server will trust the result.