TinySandyFree Online Tools

JWT Generator

Build a signed JSON Web Token for local development: write the claims as JSON, choose HS256, HS384 or HS512 and enter the shared secret. The token is signed with the browser's Web Crypto API and broken into its header, payload and signature so you can see what each part holds.

Encoding & Security Runs in your browser

Create a Test JWT

For development and testing only. Never put real production secrets into a website, and never use a token made here to access real systems. HMAC tokens are only as secure as the secret.

How to Use the JWT Generator

  1. Edit the payload JSON (the classic jwt.io example is filled in).
  2. Enter the secret and choose the algorithm.
  3. Optionally add iat (issued at) and exp (expiry) claims.
  4. Press Generate and copy the token.

About This Tool

Developers testing APIs that expect a bearer token, people writing integration tests, and learners exploring how JWT signatures work.

Input: JSON payload + secret  ·  Output: Signed JWT.

Features and Limitations

Features

  • HS256, HS384 and HS512 signing with Web Crypto.
  • Optional iat and exp claims computed from your clock.
  • Colour and text breakdown of the three token parts.
  • Warns when the secret is shorter than RFC 7518 requires.

Limitations

  • Only HMAC algorithms; RS256 and ES256 need private keys and are not offered.
  • Claims are re-serialised compactly, so key order may change if you use numeric-looking keys.
  • Meant for development; a website is not a safe place for production secrets.
  • Results are computed in your browser; nothing you enter is sent to a server.

Example

With the default payload and secret your-256-bit-secret, HS256 produces the well-known token ending in SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c.

Frequently Asked Questions

Is the token encrypted?

No. The header and payload are only Base64URL-encoded; anyone can read them. The signature only proves who made the token.

Why does my server reject the token?

Check that the secret matches exactly (and whether it is Base64), that the algorithm is allowed, and that exp, nbf, aud or iss claims meet the server's rules.

How long should an HS256 secret be?

At least 32 random bytes (256 bits). Short, human-chosen secrets can be brute-forced from any token.

Can I decode a token here?

Use the JWT Decoder to inspect existing tokens.

Related Tools

More like this: all Encoding & Security tools, all Developer & Web tools or the TinySandy home page.