Understanding JSON Web Token Generation & Cryptographic Signatures
A JSON Web Token (JWT) constructed under RFC 7519 is an open, stateless serialization format designed for identity propagation and API authorization. Unlike stateful database sessions, a JWT encapsulates its own identity assertions, authorization claims, and expiration dates. To prevent unauthorized mutation of these claims, the token is appended with a cryptographic signature calculated over the combined header and payload.
HMAC-SHA256 (HS256) Signing
HMAC (Hash-based Message Authentication Code) is a symmetric signing algorithm that combines a secret key with the SHA-256 hash function. Both the token issuer and the validating service must know the shared secret to authenticate the signature.
Base64URL Encoding Standard
Each segment of the token is encoded using URL-safe Base64: + is replaced with -, / is replaced with _, and trailing = padding is omitted. This ensures safe transmission within HTTP Authorization: Bearer headers.
JWT Signing Algorithms Comparison
| Algorithm | Key Type | Hash Output | Common Architecture Scenario |
|---|---|---|---|
| HS256 | Symmetric Shared Secret | 256-bit signature | Single-service APIs & internal microservices |
| HS384 / HS512 | Symmetric Shared Secret | 384 / 512-bit signature | High-security internal infrastructure |
| none | No Key (Unsigned) | Empty signature | Debugging & environments with external transport security |
| RS256 / ES256 | Asymmetric (Private/Public) | Varies (RSA / ECDSA) | OpenID Connect, third-party OAuth providers |
Frequently Asked Questions
How does this tool sign JWT tokens securely in the browser?
The encoder utilizes the native browser Web Crypto API (window.crypto.subtle). It imports your shared secret key into a cryptographic HMAC key object and generates a genuine SHA-256/384/512 signature over the Base64URL-encoded header and payload.
Does the “exp” claim require milliseconds or seconds?
Under the RFC 7519 specification, all JWT timestamp claims (including exp, iat, and nbf) must be represented as NumericDate values in integer seconds since the UNIX epoch (January 1, 1970 00:00:00 UTC), not milliseconds.
Is my secret signing key sent to any backend server?
No. All cryptographic HMAC operations, Base64URL encoding, and JSON parsing execute strictly inside your local browser memory via Web Crypto. Your secret key and payload never touch any network connection.