JWT Generator
Security & IdentifiersBuild and sign a test JSON Web Token
typ and alg are set automatically from the algorithm above.
Generated Token
Enter a key/secret above to generate a token.
About the JWT Generator
A JWT builder for generating test tokens — write header and payload claims, pick an algorithm, and sign with a secret (HMAC) or a private key (RSA/ECDSA), or build an unsigned token for negative testing. The companion to the JWT Debugger above, for when you need to create a token rather than inspect one.
Useful for local development and testing: minting a token with a specific role or expiration to test authorization logic, generating an expired token to confirm your app rejects it correctly, or building an alg: none token to verify a server properly refuses unsigned JWTs rather than accepting them. The token regenerates live as you edit the claims, algorithm, or key, so you can tweak a payload and immediately copy the updated result without clicking a separate "generate" button.
How to Use the JWT Generator
Write your header and payload claims as JSON.
Choose a signing algorithm and provide a secret or private key.
Copy the signed (or unsigned) token, or verify it in the JWT Debugger.
Frequently Asked Questions
Is my secret or private key sent anywhere?
No. The token is built and signed entirely in your browser using the Web Crypto API — your secret or private key is never sent to a server, the same as the JWT Debugger’s verification step.
Which algorithms are supported?
HS256/384/512 (signed with a shared secret), RS256/384/512 and ES256/384/512 (signed with a PEM-encoded PKCS8 private key), and an unsigned "none" option for testing that a server correctly rejects tokens with no signature.
Can I verify the token I just generated?
Yes — copy it into the JWT Debugger on this site (or paste the matching public key/secret there) to decode and verify it, confirming it round-trips correctly.
What are the header and payload fields for?
The payload box holds your claims (sub, role, exp, or anything custom). The header box is for extra header fields like "kid" — the standard "typ" and "alg" fields are set automatically from the algorithm you pick, so they can't drift out of sync.
Should I use tokens generated here in production?
No — this is a testing and development tool. Production tokens should be minted by your actual authentication server using securely stored keys, not pasted together in a browser tool, even a local-only one.
Can I generate a random secret instead of typing one?
Yes — the Random button next to the secret field fills it with a cryptographically random 256-bit (32-byte) secret, base64url-encoded via the Web Crypto API, so you don't have to come up with a test secret yourself.