100% Client-Side

JWT Builder

Build and sign JWTs with custom claims — HS256 via Web Crypto API

Free Client-Side No Login No Storage
Loading tool...
JWT Decoder & Inspector Decode and inspect JWT tokens — header, payload, claims at a glance JWT Encoder Create and sign JWT tokens with custom claims and headers HMAC Generator Generate HMAC message authentication codes — SHA256, SHA512, SHA1, MD5

How to Use the JWT Builder

  1. Edit the JSON payload with your claims (sub, iat, exp, etc.).
  2. Choose HS256 or none (unsigned).
  3. Enter a secret key for HS256.
  4. Click Sign JWT.

Uses Web Crypto HMAC-SHA256 for signing. No data leaves your browser.

What is JWT Builder & Token Constructor?

The JWT Builder is an interactive development environment for creating, signing, and debugging JSON Web Tokens (RFC 7519). Easily configure JOSE header parameters, inject standard claims (`sub`, `iss`, `aud`, `exp`, `roles`), customize key secrets, and test HMAC-SHA (HS256, HS384, HS512) and RSA signatures with real-time feedback.

Common Uses

  • Prototyping authentication payloads for OAuth2, OIDC, and custom API microservices
  • Generating signed mock tokens for frontend integration testing without spinning up auth servers
  • Testing token expiration handling and permission claim validations in web applications
  • Validating JWT header formats and payload claim structures

Frequently Asked Questions

What is the difference between a JWT builder and a JWT decoder?

A decoder only unpacks and inspects existing tokens. A builder allows you to author new payloads, define claims, and cryptographically compute valid cryptographic signatures using your secret keys.

Should I put private database IDs or passwords in a JWT payload?

Never store passwords, credit card numbers, or confidential secrets in standard JWT payloads. JWT payloads are only Base64URL-encoded, not encrypted, meaning anyone with access to the token can read the data.

Are the secret keys I enter here secure?

Yes. Aya Corporation operates 100% locally in your web browser. Cryptographic computations are executed via client-side JavaScript. No keys, payloads, or tokens are ever sent to any remote server.

Notes from this implementation

Claims form versus raw payload

The builder collects the claims people mistype (issuer, subject, expiry) and then signs them. It is still an HMAC token, not a session server. Expiry you set here is a number inside the payload. The decoder will show it. No one else will honor it unless they share the secret and actually check the signature and the exp claim.

Do not point this at a production signing key to “see what the token looks like” with a real user id. Mint a token with a throwaway secret and a fake subject. If you need the raw JSON instead of the form, the encoder page takes the payload as text so you can see exactly which bytes were signed.