What is a JSON Web Token?

A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit information between parties. It consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims such as user ID, roles, and expiry), and the signature.

The signature is computed by hashing the header and payload with a secret key, allowing the receiver to verify that the token was not tampered with. JWTs are stateless: all the information needed to authenticate a request is contained within the token itself.

HS256 vs HS384 vs HS512

All three are HMAC algorithms that use a shared secret key — the number is the SHA hash size in bits. HS256 is by far the most common: fast, widely supported, and secure as long as the secret is strong (at least 256 bits of entropy). For asymmetric signing, use RS256 or ES256 instead — those need a key pair and aren't covered by this tool.

HS25632-byte signature — the common default

HS38448-byte signature — rarely needed

HS51264-byte signature — rarely needed

Standard JWT claims

All registered claims are optional. The iat = now and + exp 1h buttons above are shortcuts for the two most commonly set ones during development and testing.

issIssuer — who issued the token

subSubject — usually a user ID

audAudience — the intended recipient

expExpiration time — Unix timestamp

nbfNot before — Unix timestamp

iatIssued at — when the token was created

jtiJWT ID — unique, prevents replay attacks

JWT Generator

What is a JSON Web Token?

HS256 vs HS384 vs HS512

Standard JWT claims