To generate a JSON Web Token (JWT), decide which claims the receiving application needs, choose a signing or encryption method and an appropriate key, then use a JWT library to create the token. A signed JWT protects its contents from tampering but does not conceal them. The application that accepts it must independently enforce its algorithm policy and validate the claims relevant to the request.
What generating a JWT actually does
A JWT is a compact, URL-safe representation of claims: statements such as who issued a token, who it concerns, or when it expires. It is carried in a JSON Web Signature (JWS) structure, a JSON Web Encryption (JWE) structure, or a nested combination. In compact form, the encoded components are separated by periods. The format and claims are defined in RFC 7519.
As an Amazon Associate I earn from qualifying purchases.
For a JWS, the claims are signed or protected with a message authentication code. This lets a verifier check integrity and, depending on the algorithm, the signer; it does not encrypt the payload. Anyone who obtains a typical signed JWT can decode and read its payload. Do not put passwords, API secrets, or other confidential data in one merely because it is signed. Use JWE when the application needs confidentiality and its security profile supports it.
Recommended Free Tools
Choose the claims your application requires
Claims are the token’s JSON content. Add only the information the receiving application needs, and agree on each claim’s meaning with the verifier. Common registered claims include:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
iss: issuer of the token.sub: subject, often the person or entity the token concerns.aud: intended audience, such as a particular service.exp: expiration time.nbf: time before which the token must not be accepted.iat: time the token was issued.jti: identifier for the token.
The names and definitions are listed in the IANA JWT Claims Registry. A registered claim is not automatically required in every JWT: the application defines which claims it requires and what values it accepts. If the token includes exp and the verifier processes it, the token must not be accepted at or after that time.
Generate the token with a library
- Define the token profile. Specify the intended issuer, subject, audience, lifetime, and any application-specific permissions. Ensure the issuer and verifier agree on the claims and their meanings.
- Choose the protection and key. Decide whether the application needs a signed JWS or an encrypted JWE. Select an algorithm permitted by the application’s security policy, and use a key suitable for that algorithm. Keep signing keys in appropriate key storage rather than embedding them in source code.
- Build the claims and JOSE header. Represent the claims as UTF-8 JSON. Set the JOSE header parameters, including the algorithm declaration for the chosen operation.
- Use a maintained JWT library for your language. The library serializes and protects the token in compact form. For example, the official PyJWT documentation describes a Python library for encoding and decoding JWTs, while the JJWT project documentation covers a Java implementation and its key-strength requirements for selected algorithms. Consult the current documentation for your language, library version, and security profile rather than copying an example without checking its assumptions.
- Deliver the token through the intended application channel. Treat it as a credential if possession grants authority, and avoid exposing it in places such as logs or URLs where unintended parties may obtain it.
RFC 7519 specifies the claims, UTF-8 representation, JOSE header, and JWS/JWE creation process; it does not require a particular programming language or library.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Verify a JWT before trusting it
Generation alone does not make a token acceptable. The receiving application needs a defined validation policy. RFC 8725, the IETF’s JSON Web Token Best Current Practices, gives specific guidance on algorithm selection, issuer and subject checks, audiences, and unsafe header handling.
- Allowlist algorithms in application configuration. Do not let an untrusted token header decide which algorithms the verifier will accept. RFC 8725 says: “Libraries MUST enable the caller to specify a supported set of algorithms and MUST NOT use any other algorithms when performing cryptographic operations.” Use each key with exactly one algorithm, and ensure the header’s algorithm matches the intended cryptographic operation.
- Associate keys with trusted issuers. Validate the issuer and subject, or the issuer-subject pair, when those claims are part of the application’s trust rules. Reject values the application does not recognize.
- Check the audience when relevant. If an issuer creates tokens for multiple applications or relying parties, reject a missing or mismatched
audvalue. - Enforce time and authorization rules. Validate applicable time claims such as
expandnbf, along with every application-specific permission or scope the requested operation requires. A valid signature alone does not show that a token is intended for this service or authorizes this action. - Handle token-controlled key references cautiously. Do not treat a
kidvalue as trusted input to an unsafe lookup. Do not blindly fetch URLs fromjkuorx5u; RFC 8725 identifies risks including injection and server-side request forgery.
Select a library for your stack and policy
Choose a library based on the language and runtime you use, its support for the required algorithms and key types, its ability to constrain accepted algorithms, and its integration with key storage and rotation. Check that it supports the claims validation your application needs and has current, usable documentation. The Python and Java projects above are examples, not a universal recommendation; the appropriate implementation depends on your stack and security requirements.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
