Generate an HS256 JWT for API Auth Testing

Generate an HS256 JWT for API Auth Testing

This example pre-fills the JWT Generator with an HS256 configuration and a full set of standard claims. You will get a signed JWT you can paste into your API client, curl command, or integration test.

The tool constructs the JWT header {"alg":"HS256","typ":"JWT"}, builds a payload with your claims, and signs the encoded result using HMAC-SHA256 with the provided secret. The output includes the final JWT string, a breakdown of the three dot separated sections (header, payload, signature), and the signing key used.

When to Use HS256

HS256 (HMAC with SHA-256) is a symmetric signing algorithm. The same secret signs and verifies the token. This makes it fast and simple, but it means every service that needs to verify a token must know the secret.

HS256 works well for monoliths, single page apps with a backend, and development/testing environments where you control both ends.

Anatomy of the Generated Token

The tool generates three parts separated by dots:

Header (base64url decoded):

{"alg":"HS256","typ":"JWT"}

Payload (base64url decoded):

{
  "sub": "user_abc123",
  "name": "Alice Smith",
  "email": "alice@example.com",
  "iss": "https://api.dev",
  "exp": 1735689600,
  "iat": 1735686000,
  "jti": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

Signature: HMAC-SHA256 of base64url(header).base64url(payload) using the provided secret.

The exp claim is set to one hour from generation. The iat (issued at) and jti (JWT ID) claims are auto-generated.

How To Use This Token

1. Click Generate to create a signed JWT with the prefilled values.
2. Copy the token string using the copy button next to the output.
3. Add it to your HTTP request as an Authorization header:

   Authorization: Bearer <token>

4. In curl: curl -H "Authorization: Bearer <token>" https://api.example.com/endpoint
5. Paste the token into the JWT Decoder tool to inspect the decoded payload without writing code.

Common Gotchas

The sub claim should be a stable identifier for the user, not an email or username that can change. Use a database ID or UUID. The iss claim should match the expected issuer value your API middleware checks against. Many JWT libraries reject tokens where iss does not match the configured expected issuer.

If you change the secret, all previously issued tokens will fail verification immediately. Plan for secret rotation by supporting multiple valid secrets during transition windows.

Related Tools

Use the Hash Generator to verify HMAC behavior with different inputs. The JWT Decoder can inspect any JWT you generate, including tokens from third party identity providers.