JWT Generator
Generate new JWT tokens with custom header and payload
Choose a Tool
Generate new JWT tokens with custom header and payload. All processing happens locally in your browser - no data is sent to any server.
How to generate a signed JWT
Write the header and payload as JSON, add your secret, and the tool signs the token with HMAC.
- 01
Set the algorithm in the header JSON
The header starts as {"alg": "HS256", "typ": "JWT"}. Change alg to HS384 or HS512 if your server expects those. Other algorithms such as RS256 need a private key and aren't supported here.
- 02
Write the payload claims you want to test
Edit the JSON directly. Add sub, role, tenant IDs or anything your API reads. The tool doesn't add iat or exp for you, so include them if your server checks them.
- 03
Enter the same secret your server uses
The secret is treated as plain UTF-8 text. If your backend stores its secret base64-encoded and decodes it before use, the tokens won't match.
- 04
Generate and copy the token
You get header.payload.signature in base64url, ready for an Authorization: Bearer header in curl or Postman.
What the signature is made from
The generator encodes the header and payload as base64url, joins them with a dot, and runs HMAC over that string using your secret and the hash named in alg. The result, base64url-encoded, is the third part of the token. Change one character of the payload and the signature changes completely.
We checked the output against the well-known example on jwt.io: the default header and payload signed with the secret your-256-bit-secret produce the signature ending in ssw5c, the same as any standard library.
| alg | Hash | Signature size | Signature length in token | Minimum key size (RFC 7518) |
|---|---|---|---|---|
| HS256 | SHA-256 | 32 bytes | 43 characters | 256 bits (32 bytes) |
| HS384 | SHA-384 | 48 bytes | 64 characters | 384 bits (48 bytes) |
| HS512 | SHA-512 | 64 bytes | 86 characters | 512 bits (64 bytes) |
Mistakes that make test tokens fail
Times in milliseconds are the most common. JWT times are Unix seconds, a 10-digit number today. JavaScript's Date.now() returns milliseconds, 13 digits, so a token with exp set from it looks valid for tens of thousands of years, or gets rejected by servers that sanity-check the value.
Invalid JSON is the next one. Keys and strings need double quotes, and trailing commas aren't allowed, so {sub: '123',} fails where {"sub": "123"} works. And watch for an alg mismatch: a server configured for HS512 will reject an HS256 token even when the secret is right.
What developers generate test tokens for
Testing role-based access
Sign one token with "role": "admin" and another with "role": "viewer", then hit the same endpoint with each to confirm the permissions check.
Forcing an expired-token response
Set exp to a time in the past and check that your middleware returns a clean 401 rather than a 500 error.
Scripting local integration tests
Generate a long-lived token for a dev database once, and paste it into curl scripts or a Postman environment.