JWT header and payload construction

Developers and integration teams can prepare a token when they need to assemble and inspect its header and payload before technical use.

Build the header and payload of a JWT in a coherent structure, giving an integration team the token components it needs to review.

How to use

Write the payload as JSON, including the claims your integration expects to find in the token.
Paste that JSON into the input area or import a text file that contains the same structure.
Start the construction to assemble the header and payload into a readable JWT structure.
Inspect the result and confirm that the payload is still valid JSON and that the header matches the expected token type.
Copy the resulting string for testing in your development environment, without placing any real secret in it.

Example

The sample payload contains a demo user identifier, a role, and an issued-at value. After construction, check whether those fields are still present and whether the resulting token structure can be read by your decoder.

Input

{"sub":"demo-user","role":"editor","iat":1700000000}

Limits and formats

The tool assembles a structure; it does not create a cryptographic signature or replace a dedicated JWT library.
Do not place personal data, passwords, or secrets in the payload if the token will be shared.
A JWT is not encrypted, so anyone holding the token can usually read the payload fields.
Confirm every required claim expected by your API before reusing the result.
The imported file must contain a JSON payload; other formats accepted by the import control do not change that requirement.

Where processing happens

Token construction runs only in your browser. Whatever you paste or import remains on your device and is not sent to an external service. This makes the page convenient for shaping a payload before moving it into your code, provided you avoid sensitive information.

Frequently asked questions

Can I sign a JWT with this tool?

No. This page focuses on assembling the header and payload structure. To create a valid signature, use a JWT library suited to your language and keep the signing key outside the browser.

Is the payload protected?

No. In a typical JWT, the header and payload are encoded rather than encrypted. Anyone who obtains the token may read those fields, so confidential values do not belong there.

Why might my API reject the token?

Check the claims and header values against what your API expects. Also remember that a signature must be added by your application, because this builder does not perform that signing step.