JWT Generator

Generate signed JWT tokens for testing with HS256 and RS256 signing. Build tokens with standard claims, custom claims, and configurable expiration.

100% client-side. Your data never leaves your browser.

Algorithm

Keys

Claims

Custom Claims

No custom claims added

Converters & Examples

Generate an HS256 JWT for API Auth Testing

Generate a signed HS256 JWT with standard claims (sub, name, email, exp) to test API authentication middleware without a real auth server.

 Generate an RS256 JWT for OAuth2 / OIDC Testing

Generate a signed RS256 JWT with RSA key pair for testing OAuth2 and OIDC flows, including iss, aud, sub claims and 24h expiry.

Related Tools

jwt
JWT Decoder

Decode and inspect JSON Web Tokens in your browser. View the header, payload claims, and expiration status without sending your token to any server.

 sha
Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text or files. Uses the browser's Web Crypto API for SHA hashes with a pure JS fallback for MD5.

 b64
Base64 Encode/Decode

Encode and decode Base64 strings online. Handles UTF-8 text, emoji, and binary data with full round-trip support. No server, no signup.

JWT Generator

Create signed JSON Web Tokens for testing and development. Choose between HS256 (symmetric, shared secret) and RS256 (asymmetric, RSA key pair), configure standard claims, add custom claims, and generate a cryptographically valid signed token. All signing uses the browser’s Web Crypto API. No data leaves your machine.

How to Use

  1. Select your signing algorithm. HS256 uses a shared secret. RS256 uses an RSA key pair
  2. Configure the key material. For HS256, enter a secret string (at least 32 characters recommended). For RS256, click “Generate RSA Key Pair” or paste an existing private key in PEM format
  3. Fill in the claims. sub, name, email, iss, and aud are common standard claims. The JWT ID field auto-generates a UUID when Auto is on
  4. Set an expiration. Choose from 1 hour, 6 hours, 24 hours, 7 days, or enter a custom duration in seconds
  5. Add custom claims. Use the ”+ Add custom claim” button to add key-value pairs. Values that parse as JSON are stored as structured data
  6. Click “Generate Token”. The signed JWT appears in the output, ready to copy and use
  7. Send the token to the JWT Decoder to verify it decodes correctly

When You Need a JWT Generator

Testing authentication flows. You need a valid token to test your API’s auth middleware. Rather than going through a full login flow, generate a token with the exact claims and expiration you need.

Developing OAuth 2.0 / OIDC integrations. RS256 tokens are the standard in OpenID Connect. Generate signed tokens with specific issuers and audiences to test your token validation logic.

Verifying token expiry handling. Test what happens when your application receives an expired token, a token with no expiration, or a token that expires in exactly N seconds. Set custom expiration values to simulate edge cases.

Building microservice auth. When services communicate using JWTs, you need to test both valid and invalid tokens. Generate tokens with different algorithms to verify your service handles both HS256 and RS256 correctly.

Token Structure

A generated JWT has three Base64URL-encoded segments separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IlRlc3QiLCJpYXQiOjE3MTk3MDAwMDAsImV4cCI6MTcxOTcwMzYwMH0.signature

The first segment is the header, which declares the algorithm (HS256 or RS256) and token type (JWT). The second segment is the payload containing your claims plus iat (issued at) and optionally exp (expiration). The third segment is the cryptographic signature.

The iat claim is always added automatically as the current Unix timestamp in seconds. The exp claim is calculated as iat + duration and included when you set an expiration.

Need to decode and inspect a token you generated? Use the JWT Decoder. Want to understand the Base64URL encoding used in each segment? Try the Base64 Encoder/Decoder.