What this tool does
This page helps you create signed JWT tokens for local testing so you can reproduce auth flows, inspect claims and validate downstream behaviour without relying on ad-hoc scripts.
- Creates HMAC-signed JWT tokens using HS256, HS384 or HS512 algorithms directly in the browser.
- Lets developers specify custom payload claims such as sub, iss, aud, exp and any application-specific fields.
- Provides a fast way to generate realistic test tokens for API debugging, integration testing and auth flow validation without writing throwaway scripts.
How to use it
- 1
Choose the signing algorithm: HS256 for most testing, HS384 or HS512 for stronger signatures.
- 2
Enter the signing secret you want to use for this test token.
- 3
Fill in the payload claims you need, including expiry and any custom fields your application checks.
- 4
Click Generate, copy the token and use it in your API client, test fixture or integration scenario.
Example
A backend developer needs a token with a custom role claim set to admin and an expiry ten minutes in the future to test a permission guard in a new API endpoint.
Algorithm: HS256, Secret: test-secret, Claims: {sub: user-42, role: admin, exp: now+10m}Signed JWT ready to paste into an Authorization header for local endpoint testing.Use cases
- Creating test tokens for local API and frontend debugging.
- Generating sample JWTs for docs, QA and integration checks.
- Reproducing auth flows with custom claims, expiry and issuer values.
Common mistakes
Using test tokens in production requests
Tokens generated here use a manually entered secret. Never use test secrets or browser-generated tokens in production authentication flows.
Forgetting to set an expiry claim
A JWT without an exp claim does not expire. Always include expiry when generating tokens for testing so they behave like real production tokens.
Sharing generated tokens over insecure channels
Even a test token contains encoded claims. Treat it as a credential and avoid pasting it into public channels or shared documents.
FAQ
Can I use this to generate tokens for real users?
No. This tool is intended for local testing and debugging only. Production tokens must be issued by a properly secured identity server.
What is the difference between HS256, HS384 and HS512?
They all use HMAC with SHA hashing but at different digest sizes. HS256 is the most common and sufficient for testing. HS384 and HS512 produce larger signatures.
Does the generated token work with any JWT library?
Yes, as long as the library supports the chosen algorithm and you provide the same secret when verifying.
Does this tool send my secret or payload anywhere?
No. Token generation runs locally in the browser.
Can I decode the token I just generated?
Yes. Use the JWT Decoder on this platform to inspect the header and payload immediately after generation.
Privacy and security
- Token generation happens locally in the browser.
- Secrets and claims are not sent to an external service.
- That matters when you are testing internal auth flows or temporary signing keys.
Related tools
Related tools for the next step in the same workflow:
Next step
Generate the token locally, then decode it or compare claims with related auth tools if the workflow continues.