JWT Generator

A JWT generator builds a JSON Web Token from a header, a payload of claims, and a secret, then signs it so a server can trust the contents. A JWT has three base64url segments joined by dots: the header names the signing algorithm, the payload carries the claims, and the signature is an HMAC over the first two parts. This tool assembles all three from the values you supply and returns a token you can drop into an Authorization header, a test fixture, or a curl command.

The reason to generate a token by hand is testing and debugging. When you are building an API that validates JWTs, you need sample tokens with specific claims: an expired one to confirm your 401 path, a token for a particular user id, one with a custom role or scope, or one signed with a known secret so you can verify your middleware accepts it. Writing those by hand means base64url-encoding two JSON objects and computing an HMAC, which is exactly the kind of fiddly, error-prone work a tool should do. Here you paste the claims as JSON, pick HS256, HS384, or HS512, enter the secret, and the signed token appears.

You can check this online JWT generator against any verifier. Paste {"sub":"123","role":"admin","iat":1700000000}, keep HS256 with the default secret a-string-secret-at-least-256-bits-long and UTF-8 (plain text) encoding, untick Add expiry (exp), and click Generate Token. The payload already carries an iat, so the tool leaves it alone and the token is identical every time, ending in .FumKGaSAuIzRc5ZnHmLGYsG5RHGObIpl2awmuMAtJYk. Used as a JWT generator with a secret key you already have, that is the quickest way to prove both sides agree on the key bytes.

The tool also fills in two registered time claims for you. Add issued-at (iat) stamps iat with the current Unix time, unless your payload already has one, and Add expiry (exp) sets exp to the current time plus the Expires in (seconds) value, replacing any exp in the payload. There is no not-before control, so type an nbf timestamp into the payload if you need one. Time claims are what most authentication bugs come down to, so generating them in seconds since the epoch rather than milliseconds removes a common source of mistakes.

Everything happens in your browser. The payload, the secret, and the signing all run locally in JavaScript through the built-in Web Crypto API, so your secret is never transmitted, logged, or stored. That is important because a signing secret is the one value that lets anyone mint valid tokens for your system. Because the work is local the tool also keeps functioning offline once the page has loaded. Only HMAC algorithms are offered on purpose: RS256 and ES256 sign with a private key, and pasting a private key into a web page is a habit worth avoiding.