JWT Generator
Generate JWT tokens locally with JSON header and payload editors, HS256 signing, and unsigned test-token support. Perfect for authentication mocks, API integration testing, and local development workflows without external services.
Complete Guide: JWT Generator
Everything you need to know about using this tool effectively
The JWT Generator creates JSON Web Tokens with custom header, payload, and signature. You enter claims (issuer, subject, expiration, custom fields), select a signing algorithm, and the tool produces a valid JWT string. It supports HS256, HS384, and HS512 algorithms. All processing happens in the browser.
This tool Base64-encodes the header and payload JSON, then signs them using the selected HMAC algorithm with a secret key you provide. The output is a three-segment JWT string.
Testing authentication endpoints
Generate JWTs with specific claims to test API authentication middleware.
Creating mock tokens for development
Generate tokens with test user data for frontend development without a backend.
Debugging token-based auth
Create a token with known claims to compare with tokens produced by your application.
Learning JWT structure
Build JWTs to understand how claims, algorithms, and signatures work together.
Enter claims
Fill in issuer, subject, expiration, and any custom claims.
Enter a secret key
Type the HMAC secret key for signing.
Select algorithm
Choose HS256, HS384, or HS512.
Generate
Click Generate. The tool creates a signed JWT.
HS256 is the most common algorithm for symmetric signing.
Set expiration (exp) to a future Unix timestamp.
The secret key must match what your server uses for verification.
Generated tokens are for testing. Use proper key management in production.
What algorithms are supported?
HS256, HS384, and HS512 (HMAC with SHA-256, SHA-384, and SHA-512).
Is my token or key sent to a server?
No. All generation and signing happens in your browser. Nothing is transmitted.
Can I add custom claims?
Yes. Add any JSON key-value pairs to the payload beyond the standard claims.
How do I set the expiration?
Enter the expiration as a Unix timestamp (seconds since epoch), or use the time picker to set it relative to now.
Is this suitable for production?
No. This tool is for testing and development. Production JWTs should be generated by a secure server with proper key management.