JWT Generator Online — HS256, Free & Private
Build a properly signed HS256 token for testing auth flows: fill in the claims, paste a secret, and get a token your dev server will actually accept.
- Expiry presets cover the common lifetimes — 15 minutes for access tokens, 30 days for refresh-style testing.
- Add custom claims as JSON in the extra-claims box; they merge over the standard fields.
- Use a different secret from production here — generated tokens are for local testing.
A real JWT plus its secret is effectively a live session. Decoding and HS256 verification run entirely in your browser — the token and secret are never uploaded, stored, or logged.
What goes into a test token
Standard claims cover most cases: iss (who minted it), sub (which user), aud (which service accepts it), exp (hard expiry), iat (issued-at). Anything your middleware checks beyond that — role, permissions, plan — goes in as a custom claim and is signed along with the rest.
A token is only as good as its secret. HS256 uses the same secret to sign and verify, so both sides of your dev environment need the identical string; a one-character difference produces a signature mismatch, which is the most common reason a freshly generated token 'doesn't work'.
Testing expiry behavior
Generating a token that expires in 60 seconds is the fastest way to test your client's refresh flow: decode it in the JWT debugger, watch it pass, wait a minute, and confirm your app handles the 401 and refreshes rather than crashing.
Expiry is checked against the client clock, so when a token seems to 'expire immediately', the usual cause is clock skew between the issuing machine and the verifying one.
Frequently asked questions
Which algorithm does the generator use?
HS256 (HMAC-SHA-256) with a shared secret, matching the verifier in the JWT debugger. RS256 signing with a private key is a planned addition.
Can I use a generated token in production?
No — and not because of this tool. Tokens are minted with whatever secret you type; if that is a local test secret, production will reject the token. That separation is exactly the point.
Is the secret I paste uploaded?
No. Signing happens in your browser with the native Web Crypto API. The secret never leaves your device.