Build JWT claims

Assemble interoperable JWT claims such as issuer, subject, audience, and expiry.

freeworks offlinenothing uploaded
ToolJWT Claims Builder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Claim values are assembled into a JSON payload with registered names such as iss, sub, aud, exp, and iat, then serialized for compact-token use. Building claims does not sign them or establish an issuer’s authority.

  • Registered claims give common meanings to identity and time fields.

Worked example

API service token with RBAC claims
Build claims for an API access token with role and permissions
Input
											Issuer: https://auth.example.com
Subject: user-12345
Audience: https://api.example.com
Expires in minutes: 30
Include iat: true
Include jti: false
Custom claims: {"role":"admin","permissions":["read","write"]}
Output
												{
  "iss": "https://auth.example.com",
  "sub": "user-12345",
  "aud": "https://api.example.com",
  "exp": 1787663715,
  "iat": 1787661915,
  "role": "admin",
  "permissions": [
    "read",
    "write"
  ]
}

When to use this

Integration contracts, signing fixtures, and authorization requests assemble JWT payloads.

Edge cases

  • NumericDate claims use seconds, not JavaScript milliseconds.
  • An array audience and a string audience have different JSON types.
  • Adding an admin claim does not grant permission until a trusted verifier accepts it.

References