SecurityJWT Generator

JWT Generator

Sign test tokens with HMAC, RSA or ECDSA keys.

For testing only. Use throwaway keys and secrets here, never production signing keys. Anyone holding a signing key can mint tokens your services will trust.

Header and payload

Algorithm

Key ID (kid) · optional

Header · JSON; alg and kid follow the fields above

Payload · JSON claims

Claim helpers

iss · issuer

aud · audience

sub · subject

Secret

Opening it in the decoder puts the token in the page URL, so it ends up in your browser history.

About the JWT Generator

This tool builds and signs JSON Web Tokens for testing APIs and auth code. It supports the HMAC algorithms HS256, HS384 and HS512, RSA with RS256, RS384 and RS512, RSA-PSS with PS256, PS384 and PS512, and ECDSA with ES256, ES384 and ES512. Everything runs in your browser with the Web Crypto API: keys, secrets and tokens never leave the page.

You edit the header and payload as JSON. The algorithm and optional kid stay in sync with the header, and helpers set iat, nbf, exp (in an hour, a day or at a time you pick), iss, aud, sub and a random jti. HMAC secrets can be text or base64. Private keys can be PKCS#8 PEM (BEGIN PRIVATE KEY), PKCS#1 RSA (BEGIN RSA PRIVATE KEY), SEC1 EC (BEGIN EC PRIVATE KEY) or a private JWK. Generate a key pair creates a fresh key and shows the matching public key so the service under test can verify the token.

How to use it

Pick an algorithm and edit the payload.
Enter a secret or paste a private key, or generate one.
Copy the signed token, or open it in the JWT Decoder to check its claims.

Examples

Sign an HS256 token: a random 32-byte secret is filled in.
Sign an RS256 token: generate an RSA key pair, then copy the public key to your verifier.
Sign an ES256 token: uses an ECDSA P-256 key; the signature is 64 bytes.

Common questions

Can I use my production key?

Don't. This page is for testing: use throwaway keys, since anyone with a signing key can mint tokens your services trust.

Why is my HMAC secret flagged as short?

RFC 7518 requires a key at least as long as the hash: 32 bytes for HS256, 48 for HS384 and 64 for HS512.

What's the difference between RS256 and PS256?

Both use RSA keys. PS256 uses the newer PSS padding, which has a stronger security proof; RS256 is more widely supported.

JWT Decoder: decode a token and check its expiry.
Hash Generator: compute HMAC and SHA digests.
Password Generator: create a long random secret.