CalculatorsConvertersDeveloperTextAll toolsDirectory
Submit your tool Sign in
Theme
Home/Answers/Developer
How-to

How do I generate and sign a JWT for testing?

Short answer

Use a browser-based JWT generator to build a JSON Web Token from your header and payload and sign it with HS256 using a secret you provide. Everything, including the secret, stays on your device, so you can create test tokens without handing your signing key to a website.

What signing a JWT means

A JWT has three parts: a header naming the algorithm, a payload of claims, and a signature. With HS256 the signature is an HMAC of the header and payload computed with a shared secret, which is what lets a server later verify the token was not tampered with. A generator lets you set the claims, supply the secret, and produce a correctly signed token for testing an API or an auth flow.

Why the secret must stay local

The signing secret is the key to forging valid tokens, so pasting it into a website that signs the token server-side hands over the ability to mint tokens for your system. A client-side generator computes the HMAC in your browser with the Web Crypto API, so the secret never leaves your machine. Pair it with a decoder to inspect any token's header and payload while debugging.

Step by step

  1. Set the claims. Enter the payload claims, such as a subject and an expiry.
  2. Provide the secret. Type your HS256 secret. It stays in your browser.
  3. Generate the token. The tool signs the token locally and gives you the JWT to use in your tests.

Frequently asked questions

Which algorithm does it use?

HS256, which signs the token with an HMAC using a shared secret you supply.

Is my signing secret uploaded?

No. The token is signed in your browser with the Web Crypto API, so the secret never leaves your device.

Should I use these tokens in production?

No. This is for testing and learning. Production tokens should be issued by your real auth service.

Related answers