JWT Token Builder
Create a signed JSON Web Token right in your browser: type the header and payload as JSON, choose an HMAC algorithm, add your secret, and click "Build token". Companion to the JWT Token Decoder — build a token here, then decode it there.
Build a token
Signed token
Decoded preview
| Section | Key | Type | Value |
|---|
How to use
- Edit the header JSON — the
algfield is set automatically from the algorithm dropdown when you build. - Edit the payload JSON with your claims (for example
sub,name,iatandexp). - Type your secret key and choose HS256, HS384 or HS512.
- Click "Build token" (or "Load example" first to try it with a ready-made example).
- Copy the signed token and paste it into the JWT Token Decoder to verify its contents.
About JWT signing
How the signature is made
The token has three parts: header.payload.signature. The signature is an HMAC of the base64url-encoded header and payload, computed with your secret. This tool computes it with the Web Crypto API, so the secret never leaves your device.
Secure context requirement
The Web Crypto API only works in a secure context (HTTPS or localhost). If signing is unavailable, the tool shows a clear message instead of failing silently.
Frequently asked questions
What does the JWT Token Builder do?
It builds and signs a JSON Web Token from a header and payload you type in, using the secret key and HMAC algorithm you choose. The signed token is shown in a copy box with a preview of the decoded parts.
Which signing algorithms are supported?
HS256, HS384 and HS512. The algorithm you pick is written into the token header and used to compute the HMAC signature.
Does my secret leave the browser?
No. Signing happens with the Web Crypto API inside your browser. Your secret is never uploaded or sent anywhere.
Is the token payload encrypted?
No. Anyone who has the token can decode the payload because it is only base64url-encoded. Never put passwords or secrets in a token payload.
What if my header or payload is invalid?
The tool shows a clear error message with the position of the JSON problem so you can fix it before building the token.