JWT Generator
Build a signed JSON Web Token from a custom payload, an HMAC algorithm such as HS256, HS384 or HS512, and your own key, with optional expiry. Intended for development and testing, not for issuing production tokens.
FreeOnline Tool
Loading…
How to Use
- Choose the signing algorithm: HS256, HS384, HS512, and so on.
- Enter your claims as JSON in the payload box, for example {"sub":"user123"}.
- Enter the signing key in the secret box.
- Optionally set an expiry time (the exp claim).
- Click "Generate" and copy the resulting JWT string.
Features
- Supports the HMAC signing algorithms HS256, HS384, and HS512.
- Fully custom payload, so you can add any claims you need.
- Handles the standard iat (issued at) and exp (expires at) claims for you.
- Validates the payload JSON syntax so malformed input is caught before signing.
- The resulting token is ready to drop into API testing or local development. It is meant for development and testing only, not for production use.
Use Cases
Testing authenticated APIs
Generate a token carrying specific user and permission claims for use in Postman or curl, without editing any application code.
Front-end work before the backend is ready
Produce a stand-in token so front-end developers can build and test authenticated screens locally while the backend is still in progress.
Preparing unit test fixtures
Create the tokens your auth tests need, valid, expired, or scoped to particular permissions, and confirm the logic reacts correctly.
Simulating permission levels
Issue tokens with different roles and claims to exercise front-end route guards and button-level permission checks.
FAQ
Can I use the generated JWT in production?
No. This tool is for development and testing only. Production tokens should be issued by your backend using a securely stored key, and a secret you typed into a web page must never be reused in production.
How long should the secret be?
For HMAC-SHA256 use a key of at least 256 bits (32 bytes). In production, use a randomly generated secret of at least 32 characters.
How do I set an expiry time?
Add an exp claim to the payload holding a Unix timestamp in seconds. For example, the current time plus 3600 expires the token in one hour. The tool also offers relative-time shortcuts that compute exp for you.
Should I pick HS256 or RS256?
HS256 uses one shared secret for both signing and verification, which suits a single application. RS256 uses a key pair, signing with the private key and verifying with the public one, which suits distributed systems where many services verify tokens issued by one.