Free online JWT generator: mint HS256/HS384/HS512 locally with claim templates and exp/nbf shortcuts. Custom Header and Payload.
TL;DR: Free JWT generator: mint HS256/HS384/HS512 locally with claim templates, exp/nbf shortcuts, and lossless large integers. Secrets never leave your browser.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Next steps
Usage Guide
Integration work often needs a realistic JWT: calling third-party APIs, simulating a login, testing auth middleware. This tool mints HMAC JWTs (HS256/HS384/HS512) locally — claim templates, exp/nbf shortcuts, lossless large integers — and neither the secret nor the token ever leaves your machine.
1. How to use
- Pick HS256 / HS384 / HS512, or apply an Access / Refresh / Service template to prefill the payload.
- Use exp shortcuts (including “already expired”) or “nbf = now”, then tweak the JSON if needed.
- Enter a test secret → Generate → copy into Authorization: Bearer, or open the JWT decoder to inspect.
2. Typical uses
- Auth integration: mint a token with specific sub/role to exercise permission branches.
- Expiry boundaries: one-click expired tokens for 401 paths; nbf for “not yet valid”.
- Large-integer claims: snowflake IDs beyond JS safe integers keep raw digits — cross-check in the decoder.
3. A boundary that must be stressed
Browser-side signing covers HMAC only; the secret briefly lives in page memory — never paste a real production secret into any online tool, including this local one. Mint RS/ES tokens on the server. The right pattern: a dedicated test secret for integration work. This tool exists to mint test tokens fast, not to replace server-side issuance.
4. What each template is for
- Access: short-lived access-token skeleton for API middleware and permission claims.
- Refresh: longer-lived shape often paired with rotation — this page only mints the shape; rotation and storage stay on the server.
- Service: machine-oriented iss/aud/sub for testing audience checks between services.
5. Closing the loop with jwt-decoder
After minting, open the decoder to read the Header/Payload timeline and confirm exp/nbf. The decoder can also verify HMAC signatures locally. If verification fails, check that the secret matches and that alg was not flipped to none or a non-HMAC algorithm. Production aud/iss/revocation checks still belong on the server — this loop only covers “mint → inspect”.
6. Integration checklist (avoid false greens)
- Use a test secret, never a production one; follow your environment's length and charset rules.
- Prepare at least: a valid token, an expired token, a future-nbf token, and one missing a required claim.
- Assert that the server verifies the signature instead of only base64-decoding the payload — decode-only means anyone is admin.
- Record the alg and critical claims so teammates can reproduce the same failing case.
7. Algorithm and time-window checks
Signing supports common HMAC algs (HS256/384/512) — secret and alg must match the verifier. Templates can set iat/exp/nbf; allow for clock skew/leeway. alg=none is unsafe outside demos. Never paste production secrets into a shared screen.
FAQ
This page mints HS256, HS384, and HS512 (HMAC) locally in the browser. Asymmetric algorithms such as RS256/ES256 require a private key and should be issued on the server; use the on-site JWT decoder to inspect those tokens afterward.
The page offers claim templates (Access / Refresh / Service) plus exp shortcuts (5 minutes, 15 minutes, 1 hour, 24 hours, already expired) and an "nbf = now" button. Large integers such as snowflake IDs keep their raw digits to avoid precision loss.
At least four kinds: a valid token, an expired one, a future-nbf token, and one missing a required claim. Also confirm the server verifies the signature instead of only decoding the payload — with decode-only checks, anyone can claim to be an admin.
Never. The key briefly lives in page memory, and browser-side signing only covers symmetric HMAC — production secrets do not belong in any online tool. Prepare a separate test key for integration work, keep shared keys in a team vault or local env, and leave RS/ES signing to the server.
Access is a short-lived token skeleton for testing API middleware and permission claims; Refresh lives longer and usually pairs with rotation — this page only shapes the token, while rotation and storage stay server-side; the Service template leans on iss/aud/sub machine identity for testing whether service-to-service auth checks the audience.
Open it in the on-site JWT decoder to inspect the Header/Payload timeline and confirm exp/nbf behave as intended; the decoder can also verify HS-family signatures locally. If verification fails, check two things first: whether the key is the same one, and whether the Header alg was switched to none or a non-HMAC algorithm — editing the Header without re-signing also yields an invalid signature.
Related Tools
Related Articles
Online JWT Generator/Decoder: JSON Web Token Tool
Learn JWT (JSON Web Token) structure, how it works, and use cases. Mint and decode JWTs with a local browser tool, plus practical signing hygiene.
Base64 vs Base64URL: Padding, JWT Segments, and PEM Line Wraps
Standard Base64 and Base64URL differ in alphabet and padding. Learn how JWT’s three segments use Base64URL, why PEM wraps at 64 characters, and how to stop decode failures when tools disagree.
JWT exp/nbf Clock Skew: Seconds vs Milliseconds, Leeway, and “Expired on Issue”
When JWT verification says Token expired or used before issued, check NumericDate units (seconds vs ms), NTP, and 30–60s leeway. Use the on-site decoder timeline and alg=none warning — and separate TLS cert failures from app-token 401s.