1. [Home](https://www.toolcomb.com/) 2. [Security Tools](https://www.toolcomb.com/security-tools) 3. JWT Generator # JWT Generator - Build HS256 JSON Web Tokens Online Generate a JWT with a custom header and payload. Create signed HS256 test tokens or unsigned demonstrations in your browser with no account. ### Header JSON _{ "alg": "HS256", "typ": "JWT" }_ ### Payload JSON _{ "sub": "1234567890", "name": "Jane Developer", "iat": 1516239022 }_ HMAC secret (HS256) _test-secret-key_ Unsigned (alg none) Generate JWT ### Token Copy token ``` Generate a token to see output… ``` ## What is a JWT generator (and when should you use one)? A JSON Web Token generator builds the three-part JWS structure - header, payload, and signature - from JSON you supply. Developers use generators while learning OAuth flows, writing integration tests, reproducing bug reports from customers, and prototyping API gateways before wiring a real identity provider. The output is a single compact string suitable for Authorization: Bearer headers and Postman environments. An HS256 test token uses a shared secret: the receiving service must use the matching secret to check its signature. Generating a token here is useful for learning and testing, but it does not prove that an API will accept it. Unsigned tokens with alg none are a teaching tool and a security anti-pattern in production. Some legacy misconfigurations accepted none algorithms; modern libraries reject them. This page offers unsigned output only with an explicit warning so you can demonstrate why verification must pin allowed algorithms. Claims in the payload are not encrypted - anyone can base64-decode part two. Generators help you practice adding exp, iss, aud, and scope claims, but never put passwords, credit cards, or PII in JWT payloads unless you also encrypt (JWE) or accept public readability. Pair this generator with a decoder to round-trip your work: mint a token here, paste into jwt-decoder, confirm header alg matches and payload JSON is exact. For RS256 you need a private key outside this tool - asymmetric signing is not exposed because PEM private keys should not be pasted into web forms. Use a disposable test secret rather than a production signing key. Browser extensions, shared screens and other software on a device can create risks even when processing happens locally. Production token issuance needs appropriate key protection and access controls. Understanding manual JWT construction clarifies why clock skew breaks exp validation, why trailing whitespace in secrets causes signature mismatch, and why base64url differs from standard base64 - skills that pay off when debugging 401 responses at 2 a.m. OAuth 2.0 and OpenID Connect flows issue JWT access and ID tokens from authorization servers. While production systems fetch tokens through standardized endpoints, engineers still hand-build sample JWTs when writing contract tests for resource servers, mocking Auth0 rules, or documenting expected claim shapes for partner integrations. A generator that exposes raw JSON inputs teaches which claims are custom versus registered, and why aud must match your API identifier when validators are strict. Microservice meshes sometimes propagate user context as internal JWTs signed with a cluster-wide secret. Before adopting that pattern, teams prototype claim names (tenant_id, roles, scopes) and measure header size impact on HTTP/2 streams. Oversized headers trigger 431 errors on some gateways - experimenting with compact JSON in a browser tool surfaces formatting mistakes early. Security reviewers may check that unexpected signing methods are rejected. An unsigned demonstration can help explain why an accepting application must use an explicit allowlist and verify the signature before trusting claims. Refresh tokens are usually opaque, but some legacy systems used JWT refresh tokens too. If you must inspect their shape, generate parallel access and refresh payloads with different exp values and compare decoded previews. Never reuse the same secret across services; the generator’s disposable secret field reinforces rotating keys per environment. Regulatory environments may restrict pasting even test tokens into SaaS. Because ToolComb runs locally, air-gapped-style workflows (paste on an offline VM browser) remain possible, though organizational policy still governs whether sample payloads may contain synthetic PII resembling production. Base64url omits padding equals signs and swaps +/ for -_. If you manually concatenate segments, one wrong character yields signature failure. The decode preview on this page confirms your header alg and typ survived encoding - a quick sanity check before you spend an hour tracing server-side HMAC key encoding (UTF-8 vs binary) mismatches. Standard registered claims (RFC 7519) include iss, sub, aud, exp, nbf, iat, and jti. Resource servers often enforce aud strictly so a token minted for one API cannot be replayed against another microservice behind the same gateway. When generating samples, mirror production claim names exactly - renaming role to roles or putting scopes in a nested object breaks validators that expect a flat JSON shape learned from your IdP documentation. Nested JSON objects and arrays are valid inside payloads, but some legacy middleware only supports string claims. Generating tokens here lets you test whether your API deserializes nested tenant metadata or flattens it incorrectly. Keep nesting shallow for header size; deeply nested JSON blows past reverse-proxy header limits faster than flat key-value pairs. Clock skew between token issuer and verifier causes intermittent 401 errors near exp boundaries. When testing, set exp several minutes in the future and include iat slightly in the past to mimic real issuance delay. The decode preview helps confirm timestamps are numbers, not strings - a common copy-paste mistake from JSON exported out of spreadsheets. Third-party penetration tests sometimes ask whether your service accepts tokens with unexpected alg headers. Building both HS256 and unsigned samples locally supports remediation tickets without exposing production signing keys. Document that verification code uses an explicit allowlist rather than trusting the alg field from untrusted input alone. ## How to generate a JWT with HS256 Edit header and payload JSON, enter a test secret, then generate. Preview decodes the parts you built. 1. **Edit header JSON** Use the default HS256 header for a signed example, or choose the unsigned mode for a security demonstration. 2. **Edit payload JSON** Add the claims you want to test, such as sub and exp. The payload must be valid JSON. 3. **Enter a test secret** For signed tokens, enter a disposable secret rather than a production signing key. 4. **Generate the token** Click Generate JWT, then copy the resulting three-part token. 5. **Inspect the result** Check the decoded header and payload. A decoder can display the claims but does not verify the token signature. ## Example: HS256 test token ### Before Header HS256, payload with sub and name, secret test-secret-key. ### After Three segments separated by dots; signature changes if any byte of header, payload, or secret changes. Rotating the secret invalidates all outstanding HS256 tokens - plan rotation with dual secrets in production. ## JWT generator use cases ### 1. API manual testing Mint Bearer tokens for staging when IdP is unavailable. ### 2. Teaching OAuth/OIDC Show students how claims map to encoded bytes. ### 3. Unit test fixtures Copy predictable tokens into Jest or pytest mocks. ### 4. Gateway policy debugging Test Kong or Envoy JWT plugins with known signatures. ### 5. Security training Demonstrate alg none rejection requirements. ### 6. Cross-team support Reproduce customer token shape without sharing their real secret. ### 7. Load balancer JWT validation When AWS ALB or similar validates HS256 tokens at the edge, generate sample tokens with the same secret length and charset your policy expects. Catch issues where UTF-8 multibyte secrets differ between Node Buffer and Java string bytes before go-live. ### 8. Documentation examples Technical writers embed reproducible tokens in docs by documenting header, payload, and a disposable secret. Readers regenerate identical strings locally instead of copying expired tokens from screenshots. ### 9. Mobile client handshake rehearsal Mobile teams paste expected claim shapes from backend OpenAPI into the payload editor, generate tokens with staging secrets, and verify native HTTP clients attach Authorization headers correctly before the real OAuth refresh flow is wired. Catching Base64 or header name typos early avoids week-long integration delays. ### 10. Chaos and failure injection SRE drills include sending expired or wrongly signed tokens to canary services. Operators regenerate tokens with past exp or altered payload bytes to confirm monitoring alerts on 401 spikes and that circuit breakers do not confuse auth failures with upstream outages. ### 11. Partner sandbox onboarding B2B APIs issue HS256 tokens to partners in sandboxes only. Partners use a generator matching your documented header and claim schema to prove they can sign before you exchange production secrets through a vault - reducing back-and-forth email with opaque invalid token errors. ## HS256 vs RS256 vs unsigned Choose algorithm based on who holds signing material. | Mode | Keys | This tool | | --- | --- | --- | | HS256 | Shared secret | Supported in your browser | | RS256 | Private/public key pair | Not supported (paste risk) | | alg none | No signature | Demo only with warning | | JWE | Encryption | Out of scope | Production APIs should pin allowed algs and validate exp/iss/aud on every request. Symmetric HS256 fits single-tenant internal APIs where one service both mints and verifies tokens. Asymmetric RS256 fits public clients that cannot hold signing keys. Never accept alg none or allow attackers to swap RS256 tokens for HS256 verified with the public key as if it were an HMAC secret - a known algorithm confusion class. This generator keeps you in HS256 or explicit unsigned demo territory so you can teach those boundaries without importing private keys into the browser. ## Limits and safety - HS256 only for signing; no RSA/ECDSA key import or certificate-based x5c headers. - Educational - do not paste production HMAC secrets or customer production payloads containing real PII. - Unsigned tokens must never be accepted by live APIs; the toggle exists solely for security awareness training. - No key rotation, JWKS fetch, OIDC discovery, or refresh-token exchange - only static JSON you type. - Large payloads may exceed gateway header limits (common thresholds near 8–32 KB depending on proxy). - Unicode in claims is encoded as UTF-8 in JSON; some older validators mishandle non-ASCII sub values. - Does not validate JSON schema against your IdP - typos in claim names are your responsibility. - Signing requires a secure browser context such as HTTPS or localhost; plain HTTP on a local network may block it. ## Privacy Generation runs locally in your tab. Secrets, payloads, and resulting tokens are not uploaded to ToolComb or third-party analytics from this page logic. Clear the page before sharing your screen; browser extensions with DOM access could read textarea contents. Corporate DLP, screen recorders, and clipboard managers may still capture tokens you copy - treat generated strings like live credentials during demos. No server-side audit log exists because no server participates in signing; compliance teams in regulated industries should prefer on-prem CLI tools if policy forbids browser crypto entirely. Browser devtools memory may retain strings until the tab closes; use a fresh profile for sensitive dry runs. Shared computers risk the next user reading unfocused textarea content - clear fields or close the tab when finished. ## Frequently Asked Questions ### Does this JWT generator sign tokens? Yes. For HS256 the tool computes HMAC-SHA256 via the browser Web Crypto API over the exact signing input base64url(header) + '.' + base64url(payload), then appends the base64url-encoded signature as the third segment. The result matches what server libraries produce when they use the same UTF-8 secret bytes and compact JSON serialization. ### Can I generate RS256 tokens? No. This tool supports HS256 and an unsigned demonstration mode. For other signing methods, use your identity provider or a suitable trusted signing environment. ### What is unsigned alg none? An unsigned JWT sets alg to none and omits a valid MAC. The token still has encoded header and payload, but anyone can alter claims without detection. It is useful only to teach why servers must reject none and pin algorithms. Never enable alg none acceptance in production middleware. ### Are payloads encrypted? No. JWS payloads are only base64url-encoded JSON, readable by anyone holding the token string. Confidential data requires JWE (JSON Web Encryption) or keeping secrets out of tokens entirely. Treat JWTs like signed postcards, not sealed envelopes. ### Is my secret sent to ToolComb? No. Signing runs entirely in your browser using SubtleCrypto. No network request carries the secret or generated token unless you manually send it elsewhere. ### Why does my API reject the token? Common causes: wrong secret encoding (UTF-8 vs raw bytes), alg mismatch, expired exp, missing required iss or aud, clock skew, or altered whitespace in JSON changing the signature input. Decode the token and compare claims and header alg against your server configuration line by line. ### Can I set exp and iat? Yes. Add Unix epoch seconds as JSON numbers in the payload, for example exp set to now plus 3600 and iat set to current time. Do not quote timestamps as strings unless your validator explicitly expects strings - most libraries require numeric claims. ### Is this for production? No. Production issuance belongs in hardened services with HSM-backed or vault-stored keys, rotation, audit trails, and rate limits. This page is for learning, fixtures, and staging experiments with disposable secrets only. ### How do I verify the token? Use ToolComb JWT Decoder to inspect header and payload without the secret. Full verification requires your API to recompute the HMAC with the shared secret and compare signatures in constant time, or to validate asymmetric signatures with the issuer public key. ### Free? Yes. Unlimited local generation with no account or usage cap beyond browser performance. ### What claims should I include in a test JWT payload? At minimum use sub for subject identity, iat for issued-at, and exp for expiration during API testing. Add aud and iss when your resource server validates them. Custom claims belong in a namespace or prefixed keys per your org convention. Keep payloads small to avoid oversized Authorization headers on mobile networks. ### Why does base64url matter for JWT segments? JWT uses base64url encoding without padding so tokens are URL-safe in query strings and headers. Standard base64 plus and slash characters would break URLs and require extra escaping. If you manually edit segments, any invalid character causes signature verification failure on the server. ## Related tools - [JWT Decoder](https://www.toolcomb.com/jwt-decoder) - Decode and inspect tokens you generate. - [Hash Generator](https://www.toolcomb.com/hash-generator) - Related HMAC/SHA concepts. - [Base64 Encoder](https://www.toolcomb.com/base64-encoder) - Compare with base64url encoding. - [Password Generator](https://www.toolcomb.com/password-generator) - Generate disposable test secrets. ## Related Tools Discover more free tools that might help with your next task. [Base64 Encoder Encode and decode Base64 data Use Tool](https://www.toolcomb.com/base64-encoder) [URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder) [HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder) [Hash Generator Generate MD5, SHA1, SHA256 hashes Use Tool](https://www.toolcomb.com/hash-generator) [UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator) [Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator) ### Related guides Read the how-to, then come back to this tool when you are ready to run it locally. - [JWT Generate vs Decode - What Belongs in the Browser Decode claims locally, generate test tokens with dummy keys - never mint production JWTs or paste live secrets into any website tab.](https://www.toolcomb.com/blog/jwt-generate-vs-decode-safely) [View All Tools](https://www.toolcomb.com/tools)