JWT Generator
Generate signed JSON Web Tokens with HS256, HS384, HS512, RS256, or ES256. Build payloads with standard claims.
HMAC: any string works as secret. RSA/ECDSA: paste a PEM private key (PKCS#8).
Valid JSON. These are merged into the payload after the standard claims.
About this tool
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and authorization between services. It consists of three Base64URL-encoded parts — header, payload, and signature — separated by dots.
Use this tool to generate test tokens during development: pick an algorithm, fill in standard claims (issuer, subject, audience, expiry), add custom claims, and sign with a secret or private key. The HMAC algorithms (HS256, HS384, HS512) accept any string as the secret; RSA and ECDSA require a PEM-formatted private key.
Example: with HS256, payload {“sub”: “alice”, “role”: “admin”, “iat”: 1710000000, “exp”: 1710003600} and secret my-secret produces a signed token you can paste directly into the JWT Debugger to verify.
FAQ
What algorithms are supported? ›
HS256, HS384, HS512 (HMAC with any secret string), RS256 (RSA PKCS#1 v1.5 with SHA-256), and ES256 (ECDSA P-256 with SHA-256). HS* algorithms are the easiest — just pick any string as your secret.
How do I get a PEM private key for RS256 or ES256? ›
Generate one with OpenSSL. For RSA: <code>openssl genpkey -algorithm RSA -out private.pem -pkeyopt rsa_keygen_bits:2048</code>. For ECDSA: <code>openssl genpkey -algorithm EC -out private.pem -pkeyopt ec_paramgen_curve:P-256</code>. Then paste the contents of private.pem into the secret field.
What is the difference between iat, nbf, and exp? ›
<strong>iat</strong> (issued at) records when the token was created. <strong>nbf</strong> (not before) means the token is invalid before this time. <strong>exp</strong> (expiration) means the token is invalid after this time. All are in seconds since the Unix epoch.
Can I use this to generate tokens for production? ›
This tool is for development and testing. Production tokens should be generated by your authentication server using a securely stored key. Never paste production secrets into a web tool.
How do I decode or verify a token I just generated? ›
Copy the generated token and paste it into the JWT Decoder & Debugger — it decodes the header and payload instantly, verifies the signature (HS256/RS256/ES256), and checks expiration. The two tools are complementary: generate here, verify there.