devprix.io

JWT Builder

Create, sign, and verify JSON Web Tokens with HMAC algorithms using the Web Crypto API.

Used as raw UTF-8 bytes. It stays in your browser and is never put in share links.

PayloadJSON claims
Headeralg follows the toolbar
TokenHeaderPayloadSignature
Signing…
Decodedwhat the token carries
Nothing to decode yetThe signed token’s header and payload show here.

Standard claims

Custom claim

Sample tokens

Waiting for inputProcessed locally
Send output toJWT Decoder

How to use it

  1. Edit the payload claims (or load a sample) and pick HS256, HS384 or HS512.
  2. Enter your secret — or generate a random one — and the token is signed as you type; press Sign to re-sign now.
  3. Copy the token or a ready cURL command, or switch to Verify token to check a signature with its secret.

Related tools

JWT DecoderFormatBase64 Encoder & DecoderConvertPassword GeneratorGenerate

What is a JWT Builder?

A JWT builder creates and signs JSON Web Tokens for testing and development. You can define custom header and payload claims, set expiration times, and sign tokens using HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 algorithms. The builder uses the Web Crypto API for client-side signing — your secret key never leaves your browser.

Common use cases

  • Creating test tokens for API development and debugging
  • Building JWTs with specific claims for integration testing
  • Generating tokens with custom expiration for testing auth flows
  • Learning how JWT signing and verification works
  • Creating sample tokens for API documentation

Frequently asked questions

Is it safe to sign JWTs in the browser?

For development and testing, yes. The signing happens entirely client-side using Web Crypto API. However, in production applications, JWTs should be signed on the server where the secret key is securely stored.

What claims should a JWT include?

Common claims are: iss (issuer), sub (subject/user ID), exp (expiration time), iat (issued at), aud (audience), and custom claims like roles or permissions. At minimum, always include exp to prevent tokens from being valid forever.