Generators
JWT Token Generator
Generate a Token
Quick Presets
User Authentication
Standard user login tokenAPI Access Token
API service authenticationRefresh Token
Long-lived refresh tokenAdmin Token
Administrative access tokenHS256 (HMAC SHA-256)
JWT header containing algorithm and token type
No JWT token generated yet
Configure your settings above and click Generate JWT Token to create your token.
Tool features
4 features
JWT Generation
Create secure JSON Web Tokens with custom claims
Multiple Algorithms
Support for HMAC, RSA, and ECDSA signing algorithms
Secret Management
Generate secure secrets or use custom keys
Token Validation
Decode and inspect JWT structure and claims
What is a JWT & how it works
A JSON Web Token (JWT) packs a set of claims (who the user is, what they may do, when the token expires) into a compact, URL-safe string that an API can verify without a database lookup. It is three Base64url parts: header, payload and signature, joined with dots.
With the HMAC algorithms (HS256, HS384, HS512) the signature is computed from the header, payload and a shared secret; any change to the claims invalidates it. Generating test tokens with realistic claims and expiry is a quick way to exercise authentication in development without running the whole login flow.
Registered claims
Standard fields: sub (subject), iss (issuer), aud (audience), exp, iat, nbf.
HS256
HMAC with SHA-256 using a shared secret; the most common algorithm.
exp
Expiry time in Unix seconds; after it, verifiers must reject the token.
How to use this tool
1
Choose the algorithm
Pick HS256, HS384 or HS512 for a shared-secret signature.
2
Set the secret
Enter a test secret or generate a random one of the right length.
3
Add claims
Fill in subject, issuer, audience, expiry and any custom claims your API expects.
4
Generate and use
Create the token and send it as Authorization: Bearer <token> to your API in development.
Frequently asked questions
5 Q&A
At least 256 bits (32 random bytes) for HS256, and correspondingly longer for HS384 and HS512. Short or guessable secrets can be brute-forced offline from a single token.
Keep access tokens short-lived, typically 5–60 minutes, and use refresh tokens to get new ones. Long-lived JWTs are hard to revoke.
No. Anyone can decode a JWT payload; the signature only proves it was not changed. Never put passwords or other secrets in claims.
Paste it into the JWT Decoder to see the header, claims and expiry.