What is the difference between JWT encoding and encryption?
JWTs are signed and Base64Url-encoded, not encrypted. The header and payload claims are readable by anyone who inspects the token string. Do not store sensitive secrets (like passwords or credit card numbers) in JWT payloads.
What are standard claims in a JWT Payload?
Standard registered claims include `sub` (user ID), `iat` (issued-at timestamp), `exp` (expiration timestamp), `iss` (issuer URL), and `aud` (audience).
How does the browser verify signature integrity?
The tool imports your passphrase or RSA private key locally using the browser's Web Cryptography API (`window.crypto.subtle`) and signs the `header.payload` string.
Which RSA key format is required for RS256 signing?
RS256 mode requires an unencrypted PKCS#8 Private Key PEM string starting with `-----BEGIN PRIVATE KEY-----` and ending with `-----END PRIVATE KEY-----`.
Can I use the generated token in Authorization headers?
Yes! Copy the generated dot-separated string and pass it in your HTTP request headers as `Authorization: Bearer <your_token>`.
Is my private signing key safe inside this tool?
Yes. All signing calculations execute 100% locally in your browser's JavaScript runtime. No keys or token payloads are sent to external servers.
What is the difference between HS256 and RS256?
HS256 uses a single symmetric secret key for both signing and verification. RS256 uses an asymmetric private key for signing and a public key for verification.
Why does the editor show JSON validation errors?
JWT headers and payloads must be written as valid JSON. Ensure keys and string values use double quotes, and check for missing brackets or trailing commas.
How are timestamp claims calculated?
JWT timestamps (`exp`, `iat`, `nbf`) use Unix Epoch timestamps (seconds since Jan 1, 1970). You can use our example payload button to populate current timestamps automatically.
Can I add custom claims to the payload?
Yes! You can add custom key-value pairs (such as `"role": "admin"` or `"email": "user@example.com"`) to the payload JSON object.
How do I set a 1-hour expiration timestamp?
In JavaScript, set `exp` to `Math.floor(Date.now() / 1000) + 3600`. The tool provides sample preset buttons to set expiration offsets easily.
What happens if a token is modified during transit?
If any character in the header or payload is altered, the signature check on the backend server will fail, rejecting the request as untrusted.
Can I decode a token after creating it?
Yes. Copy the generated token string and open our JWT Decoder tool to inspect the decoded header and payload claims.
Are there keyboard shortcuts?
Press `Ctrl+L` (or `Cmd+L` on Mac) to reset the editor inputs instantly.
