How to Generate a JWT Token (HS256/HS384/HS512) — No Library, No Server

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. You can generate signed JWT tokens entirely in your browser — no server, no library installation required — using the Web Crypto API. Use brevio JWT Generator to generate HS256, HS384, or HS512 tokens with custom claims, set expiry, and copy the result.

JWT Structure Explained

A JWT consists of three base64url-encoded parts separated by dots: header.payload.signature.

• Header: Declares the token type and signing algorithm. Example: {"alg": "HS256", "typ": "JWT"}
• Payload: Contains claims — statements about the subject plus metadata. Standard claims are defined by RFC 7519; you can add any custom claims.
• Signature: The HMAC or RSA signature of base64url(header).base64url(payload). Prevents tampering — changing any byte in the header or payload invalidates the signature.

The three parts are base64url-encoded (not encrypted). Anyone who has the token can decode the header and payload by base64-decoding them. The token proves the content has not been modified, but the payload is not secret.

Standard Claims Explained

The exp claim is the most important for security. A token without an expiry is valid forever — if stolen, it cannot be revoked without a token blocklist. Short-lived tokens (15 min to 1 hour) limit the damage if a token is compromised.

HMAC vs RSA Algorithms

The alg header determines how the signature is created and verified.

• HS256/HS384/HS512 (HMAC-SHA): Uses a single shared secret for both signing and verification. Both parties must know the secret. Fast, simple, good for monolithic apps where the same service issues and verifies tokens.
• RS256/RS384/RS512 (RSA-SHA): Asymmetric — private key signs, public key verifies. The public key can be shared openly (e.g., via a JWKS endpoint) so other services can verify tokens without access to the signing key. Required for distributed systems and OAuth 2.0 / OpenID Connect.
• ES256/ES384/ES512 (ECDSA): Asymmetric like RSA but with smaller keys and faster operations. Preferred over RSA for new implementations.

The brevio JWT Generator implements HMAC algorithms (HS256/HS384/HS512) using the browser's Web Crypto API. For RSA/ECDSA, use a dedicated library or your auth provider's SDK.

How to Generate a JWT in Your Browser

1. Open brevio JWT Generator.
2. Enter your subject (sub) — typically a user ID like user123 or a UUID.
3. Set the issuer (iss) — your application name or URL.
4. Choose an expiry — 1 hour for access tokens, longer for refresh tokens.
5. Enter your secret — use a long, random string. Never use a predictable value in production.
6. Add custom claims (optional) — any JSON object, e.g. {"role": "admin"}.
7. Click Generate JWT and copy the token.

Base64URL Encoding Explained

JWTs use base64url encoding, a URL-safe variant of standard base64. The differences: + is replaced with -, / with _, and padding = is removed. This makes JWTs safe to include in URLs and HTTP headers without percent-encoding.

Security Advice

• Never put sensitive data in the payload. The payload is base64-encoded, not encrypted. Passwords, credit card numbers, and API keys must not appear in JWT claims.
• Use strong secrets. HMAC keys should be at least 256 bits (32 bytes) of random data. openssl rand -hex 32 generates a suitable key.
• Set short expiry for access tokens. 15 minutes to 1 hour is common. Use refresh tokens for session persistence.
• Never log tokens. JWTs in log files are credentials waiting to be stolen. Redact them in all logging and error reporting systems.
• Validate all claims on the server. Check exp, iss, and aud on every request — not just the signature.

DevTools Verification

Open DevTools and check the Network tab while generating a JWT. No POST requests are made — the HMAC signing runs via crypto.subtle.sign() in your browser. Your secret and payload are never transmitted.

Command Line Alternative

# Install jwt-cli npm install -g jwt-cli # Generate HS256 token jwt sign --secret mysecret --subject user123 --expiry 1h '{"role":"admin"}'