JWT Generator

JWT Generator

Create signed JSON Web Tokens for testing and development. Choose between HS256 (symmetric, shared secret) and RS256 (asymmetric, RSA key pair), configure standard claims, add custom claims, and generate a cryptographically valid signed token. All signing uses the browser’s Web Crypto API. No data leaves your machine.

How to Use

1. Select your signing algorithm. HS256 uses a shared secret. RS256 uses an RSA key pair
2. Configure the key material. For HS256, enter a secret string (at least 32 characters recommended). For RS256, click “Generate RSA Key Pair” or paste an existing private key in PEM format
3. Fill in the claims. sub, name, email, iss, and aud are common standard claims. The JWT ID field auto-generates a UUID when Auto is on
4. Set an expiration. Choose from 1 hour, 6 hours, 24 hours, 7 days, or enter a custom duration in seconds
5. Add custom claims. Use the “+ Add custom claim” button to add key-value pairs. Values that parse as JSON are stored as structured data
6. Click “Generate Token”. The signed JWT appears in the output, ready to copy and use
7. Send the token to the JWT Decoder to verify it decodes correctly

When You Need a JWT Generator

Testing authentication flows. You need a valid token to test your API’s auth middleware. Rather than going through a full login flow, generate a token with the exact claims and expiration you need.

Developing OAuth 2.0 / OIDC integrations. RS256 tokens are the standard in OpenID Connect. Generate signed tokens with specific issuers and audiences to test your token validation logic. Try the pre-configured RS256 OAuth Token example to get started quickly.

Verifying token expiry handling. Test what happens when your application receives an expired token, a token with no expiration, or a token that expires in exactly N seconds. Set custom expiration values to simulate edge cases.

Building microservice auth. When services communicate using JWTs, you need to test both valid and invalid tokens. Generate tokens with different algorithms to verify your service handles both HS256 and RS256 correctly.

Token Structure

A generated JWT has three Base64URL-encoded segments separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IlRlc3QiLCJpYXQiOjE3MTk3MDAwMDAsImV4cCI6MTcxOTcwMzYwMH0.signature

The first segment is the header, which declares the algorithm (HS256 or RS256) and token type (JWT). The second segment is the payload containing your claims plus iat (issued at) and optionally exp (expiration). The third segment is the cryptographic signature.

The iat claim is always added automatically as the current Unix timestamp in seconds. The exp claim is calculated as iat + duration and included when you set an expiration.

Need to decode and inspect a token you generated? Use the JWT Decoder. Want to understand the Base64URL encoding used in each segment? Try the Base64 Encoder/Decoder.