How to create a JWT
- Choose the HMAC algorithm: HS256 is the most widely supported.
- Edit the JSON payload. Use + iat now and + exp to set issued-at and expiry times without doing Unix-time arithmetic.
- Enter your secret, or press Random secret to generate a strong 256-bit one.
- Press Sign token and copy the token, or copy it as a ready-made
Authorization: Bearerheader for curl, Postman or your HTTP client.
When to use a JWT generator
Generating tokens by hand is useful when you are testing an API locally, writing integration tests, reproducing an authorisation bug, or checking how your backend handles expired or malformed claims. You can create a token with an exp in the past to test expiry handling, or add a custom role claim to test permissions.
The token is signed with the Web Crypto API using HMAC, exactly as libraries such as jsonwebtoken, PyJWT and jose do, so any standards-compliant server that shares the same secret will accept it. Claims are standard JSON; times are in seconds since 1 January 1970 UTC.
Security notes
Nothing leaves your browser, but your payload and secret are remembered in local storage for convenience, so do not use production secrets on a shared computer. Use a secret at least as long as the hash output (32 bytes for HS256). Remember that the payload is readable by anyone who has the token, so never put passwords or sensitive personal data in it.
Can I create RS256 tokens here?
This generator signs with shared-secret HMAC algorithms (HS256, HS384, HS512). RS256 needs a private key, which is usually kept on a server; the JWT Decoder on this site can verify RS256 tokens with a public key.
How long should the expiry be?
Access tokens are commonly valid for 5 to 60 minutes, with a longer-lived refresh token used to get new ones. Short expiry limits the damage if a token leaks.
Why does my server reject the token?
Check the secret matches exactly, the algorithm is allowed by your server, the exp is in the future and any required claims such as iss or aud are present and correct.