Loading…
Create signed JWTs (HS256/RS256) from header+payload locally. Use when creating test tokens; for inspecting existing tokens use jwt-decoder, for Base64 parts use base64. Input: JSON header/payload + secret. Returns JWT string. 100% client-side.
JWT Generator is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
Generates JSON Web Tokens with configurable algorithm selection (HS256, HS384, HS512, or none), a header/payload builder with standard claim auto-completion, an expiry date/time picker, and a secret input field. Displays a live token preview with color-coded sections before final generation.
Testing JWT-based authentication requires valid tokens with specific claims, expiry times, and algorithms. Eliminates manual token construction and base64 encoding, providing a visual builder for rapid prototyping and testing.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Backend and API developers testing JWT authentication flows, security engineers creating test tokens, and developers integrating with JWT-based services during development.
Select the signing algorithm from the dropdown (HS256, HS384, HS512, or none for unsigned tokens)
Use the payload builder to add claims: select standard claims (iss, sub, aud, exp, nbf, iat, jti) or add custom key-value pairs
Set the expiry time using the date/time picker; the tool automatically calculates the exp claim epoch value
Enter a secret key in the secret input field; minimum length requirements vary by algorithm strength
Review the live token preview showing the three color-coded sections as you build the payload
Click "Generate" to finalize; copy the token or download it; use "Regenerate" to update with new settings
Settings: alg=HS256, secret=mysecret, claims: {sub:"123",name:"Alice",exp:2025-01-01T00:00Z} -> Output: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQWxpY2UiLCJleHAiOjE3Mzc2MDAwMDB9.signatureSettings: alg=none, claims: {role:"admin"} -> Output: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJyb2xlIjoiYWRtaW4ifQ.Settings: alg=HS384, secret=my-32-char-secret-key-here, claims: {iss:"auth-service",sub:"user-42",aud:"api",exp:<now+30m>} -> Output: three-part token with a 384-bit HMAC signatureSettings: alg=HS256, claims: {sub:"anon",jti:"a1b2c3"} with no exp -> Output: a token that never expires (useful for testing, dangerous in production)Can I generate tokens with asymmetric algorithms (RS256/ES256)?
This tool supports symmetric HMAC algorithms (HS256/384/512); for asymmetric keys, use a dedicated JWT library.
How is the expiry time calculated?
The exp claim is set as the Unix epoch timestamp of the selected date/time in UTC.
Does the tool store the generated token or secret?
No, all generation happens client-side; nothing is persisted or transmitted.
Can I generate multiple tokens at once?
The tool generates one token per configuration; use the "Regenerate" button after changing claims or settings.
Authoritative specifications, standards, and in-depth reading for JWT Generator.
Standard Claims
Claims: 3 | Size: 0 BCustom Header Fields
Custom Claims
Decode and inspect JWT header, payload and expiry locally. Debug tokens securely in browser.
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.
Free online JSON formatter and validator with syntax highlighting and error line numbers. Use as default for beautify+validate+minify in one place; for two-file comparison use json-diff, for schema generation use json-schema-generator. Input: JSON ≤10MB. Returns formatted JSON or line-numbered error. 100% private.
Compare two JSON documents and highlight added, removed, and changed keys with line-level diff. Use when comparing API responses or configs; for single-document formatting use json-formatter, for validation errors use json-validator. Input: two JSON texts ≤10MB. Returns highlighted diff. 100% client-side.
Compress JSON by stripping whitespace for smallest payload. Use when preparing production payloads; for readable output use json-formatter or json-beautifier. Input: JSON text ≤10MB. Returns minified JSON or line-numbered error. 100% client-side.
Validate JSON syntax and report errors with line numbers without reformatting. Use when only correctness matters; for auto-fix and formatting use json-formatter. Input: JSON text ≤10MB. Returns valid/invalid + error location. 100% client-side.