What is a JWT Generator?
A JWT Generator creates signed JSON Web Tokens on demand. Each JWT has three Base64URL-encoded parts joined by dots: a header that declares the signing algorithm, a payload with claims about the user or session, and a cryptographic signature. This tool lets you craft custom headers and payloads, then sign the token using HMAC with SHA-256, SHA-384 or SHA-512. The entire signing process runs in your browser via the Web Crypto API. Your secret key never leaves the page.
How to Use This Tool
Edit the JSON payload with the claims you want to include, such as sub, iss, exp, aud or any custom fields. Pick the signing algorithm and paste in your secret. Click Generate and the tool produces a ready-to-use token that you can paste into an Authorization: Bearer header for API testing.
Common Use Cases
- Crafting test tokens for Postman or curl while debugging authenticated APIs
- Simulating expired or tampered tokens to verify your server-side validation logic
- Generating short-lived tokens with specific claims for automated integration tests
- Reproducing auth bugs reported by users with a minimal token payload
Security Notes
Use strong, high-entropy secrets in production. HS256 requires at least 256 bits of key material to resist brute force. Never hard-code production secrets into client-side code or commit them to git. This tool is intended for local development and testing, where secrets are throwaway values. The signing happens entirely in your browser with Web Crypto API, so the secret is not transmitted anywhere.
Frequently Asked Questions
Does this tool support RS256 or ES256?
This generator focuses on HMAC algorithms (HS256, HS384, HS512) which use a shared secret. RS256 and ES256 require key-pair generation and PEM parsing, which add significant complexity. For asymmetric signing, use your backend's JWT library which already has the private key.
What is a good secret length?
For HS256, use at least a 256-bit (32-byte) random secret. For HS384 use 384 bits and for HS512 use 512 bits. You can generate one with our password generator or openssl rand -base64 32.
How do I decode the generated token?
Paste the token into our JWT Debugger to inspect the header, payload and signature. The debugger can also verify the signature if you provide the secret.