How a JSON Web Token is built
A JSON Web Token (JWT) is three pieces joined by dots: a header, a payload, and a signature. The header and payload are small JSON objects encoded in Base64URL, a URL-safe version of Base64 with no padding. The signature is computed over the first two parts, so a server can confirm the token was not altered.
This tool creates tokens signed with HS256, which means HMAC with SHA-256 and a shared secret. The header is fixed as {"alg":"HS256","typ":"JWT"}. You supply the payload as JSON and the secret as text. The browser's Web Crypto API computes the signature, and the three parts are joined into the final token.
Note that a JWT is encoded, not encrypted. Anyone holding the token can read the payload, so never put private information in it.
Why generate a test token
Developers use hand-made tokens to exercise an API without running a full login flow: checking that a route rejects an expired token, trying a different user ID, or confirming that middleware reads a claim correctly. Learners use it to see how a payload turns into the long string they see in browser requests.
The usual claims in a payload include sub (the subject), iat (issued at, as a Unix timestamp), and exp (expiry). The Timestamp Converter helps you turn a date into the number you need, and the JWT Decoder lets you inspect a token to confirm what is inside.
Use this for development and learning only. A token generated here is not issued by any authority, and it will only work with a system that happens to share the same secret.
How to generate a signed JWT
- Edit the Payload (JSON) box. It starts with an example containing
sub,name, andiat. - Enter your test value in Secret (HS256). It is shown as plain text, with a placeholder string filled in.
- Click Generate JWT.
- The Signed token appears below. Click Copy to copy it.
If the payload is not valid JSON, an error appears saying so. The header cannot be edited, no other algorithm is offered, and tokens are not saved anywhere.
Responsible use and common mistakes
Never paste a production secret into this or any online tool. The signing here happens locally in your browser and the secret is not sent anywhere by this page, but a secret that signs real tokens is the key to your system. Typing it into a web page, a browser with extensions, or a shared computer adds risk you do not need. Use a throwaway secret that exists only for testing, and keep real keys in a secrets manager.
Also avoid putting passwords, personal data, or API keys inside the payload. Remember that the payload is readable by anyone who sees the token.
Common mistakes include forgetting that iat and exp are in seconds, not milliseconds, using single quotes or trailing commas in the JSON, and expecting the output to work with RS256 or ES256 systems. This tool only produces HS256, so a service that verifies with a public key will reject its tokens. Remember too that the token is only as trustworthy as the secret behind it, and a short guessable secret can be brute-forced by others.