"category": "inspect-and-test",
JWT Generator (HS256)
"tldr": Type claims JSON and a secret, get a signed HS256 JWT live - test tokens for development without touching a server.
Create signed JSON Web Tokens for development and testing: edit the claims JSON, set the HMAC secret, and the HS256-signed token regenerates live. One click adds fresh iat/exp time claims so the token is valid for the next hour.
Signing runs on the browser's WebCrypto (real HMAC-SHA256, not a mock), so a token generated here verifies correctly against the same secret in jsonwebtoken, PyJWT, or any compliant library - which is exactly what you need for testing auth middleware, expired-token handling, and role-based paths without wiring up an identity provider.
How to generate a test JWT
- 1Edit the claims JSON - sub, role, and whatever your app reads.
- 2Set the secret your test server verifies against.
- 3Click "Add iat/exp" for a token valid one hour from now.
- 4Copy the signed token into your Authorization: Bearer header - and decode it anytime in our JWT Decoder.
Convert Claims to Signed JWT in code
import jwt from "jsonwebtoken";
const token = jwt.sign({ sub: "1042", role: "admin" }, secret, {
algorithm: "HS256",
expiresIn: "1h",
});import jwt, time
token = jwt.encode(
{"sub": "1042", "role": "admin", "exp": int(time.time()) + 3600},
secret,
algorithm="HS256",
)Frequently asked questions
Is it safe to type a secret in here?
Signing is fully local - no network requests, nothing stored. But defense in depth says: never type a production secret into any web page, this one included. Use throwaway secrets for test tokens; that is what this tool is for.
Why only HS256 and not RS256?
HS256 needs one shared secret, which fits a test-token workflow. RS256 requires managing a private key - and pasting private keys into a browser is a habit not worth forming. For RS256 test tokens, generate a keypair locally and sign with a library (see the code examples).
My server rejects the generated token - what should I check?
Three usual causes: secret mismatch (including trailing whitespace), the server expecting a different algorithm (pin algorithms: ["HS256"] on both sides), or expiry - a token without exp is rejected by servers that require it, so use the Add iat/exp button.
Last updated:
You might also need
Free and in-browser, like everything on JSON Console. Browse all tools →