A form instead of JSON
This page builds the payload for you. Enter who issued the token, who it is for and how long it should last, and it adds the matching claims, signs the token with your secret and shows the decoded result next to it.
What each field becomes
- Issuer becomes iss, the party that created the token.
- Subject becomes sub, usually a user ID.
- Audience becomes aud, the service the token is meant for.
- Expires in becomes exp, set to the current time plus your duration.
- Issued at becomes iat, the moment of creation.
- Token ID becomes jti, a random identifier, useful for revoking tokens.
Custom claims
Add your own claims as a JSON object, such as a role or a tenant ID. They are merged into the payload. Do not put secrets or sensitive personal data in a token, because the payload can be read by anyone who has the token.
The secret
The token is signed with HMAC SHA-2 using your secret. A secret should be long and random: at least 32 bytes for HS256. The default value is for testing only. Create a new token whenever you change a field, as the time claims use the moment you generate it.
Next steps
For full control over the header and payload, use the JWT encoder. To set times with a calendar and presets, use the claims builder. The guide explains how the pieces fit together.