JWT Generator

Create HS256 signed JSON Web Tokens for testing, with your own payload and secret.

How to Use JWT Generator

  1. Edit the payload JSON with the claims you need, such as sub, name or role.
  2. Enter the secret key your server uses to verify HS256 tokens.
  3. Set Expires In, for example 30m, 2h or 7d.
  4. Click Generate JWT and copy the token.

How the token is built

The tool signs your payload with HMAC SHA-256 (HS256) using the open-source jose library. It adds iat (the time the token was made) and exp (that time plus your expiry) automatically, so an exp already in your payload is replaced. Expiry accepts a number with a unit: s, m, h, d, w or y, such as 45s, 15m or 1w.

Your server will accept the token only if it uses the same secret and expects HS256. Tokens signed with RS256 or ES256 need a private key, which this tool doesn't handle.

Choosing a secret

For HS256 the secret should be long and random, at least 32 characters. Short or guessable secrets can be cracked offline from a single token. Signing happens in your browser and nothing is uploaded, but it's still good practice to use test secrets here rather than the key that protects your live users. The Password Generator can make a strong random secret.

Key Features & Practical Use Cases

  • Making a test token to call your own API while developing.
  • Mocking a logged-in user in local or staging environments.
  • Testing how your backend handles expired tokens by setting a short expiry.
  • Learning how JWT signing works by changing the payload and watching the token change.

Frequently Asked Questions

Which algorithms are supported?

HS256 only. It's the most common choice for apps that sign and verify tokens with one shared secret.

Why does my server reject the token?

Usually the secret differs, the server expects another algorithm, or it checks claims like iss or aud that aren't in your payload.

Can I make a token that never expires?

Not with this tool; an expiry is always added. You can set a long one such as 1y for testing.

Can I check the result?

Yes. Paste it into the JWT Decoder to see the header, payload and expiry.

About OneClickly

OneClickly is a set of 119 free tools for PDFs, images, text, everyday math and code. They run in your browser, so the files and text you work with stay on your device.

Related Tools

  • Base64 Encoder/Decoder - Encode text to Base64 or decode it back, with UTF-8 and URL-safe support.
  • URL Encoder/Decoder - Encode special characters in URLs (percent-encoding) or decode them.
  • HTML Encoder/Decoder - Escape special characters as HTML entities, or decode entities back to plain text.
  • JWT Decoder - Read the header, payload and expiry of a JSON Web Token in your browser.
  • Hash Generator - Get MD5, SHA-1, SHA-256 and SHA-512 hashes of any text as you type.
  • Bcrypt Hash Generator - Create bcrypt password hashes and check a password against an existing hash.