JWT generator
Runs in your browser; nothing is uploaded
Build and sign a JSON Web Token with HS256, RS256, PS256 or ES256 (and their 384 and 512 versions). Write times as now or +1h. Signed in your browser; the secret and key are never sent or put in share links.
Claims
Secret
Token
Nothing yet
How a JWT is signed
A JSON Web Token has three parts separated by dots: a header saying how it's signed, a payload of claims (who the token is for, who issued it, when it expires), and a signature. The first two are Base64url-encoded JSON that anyone can read; the signature proves they weren't changed by someone without the key.
HS256, HS384 and HS512 sign with a shared secret: whoever verifies the token needs the same secret. RS256 and PS256 sign with an RSA private key, ES256 with an elliptic-curve key; whoever verifies needs only the public key, so the private key stays with the issuer. That's why identity providers use RS256 or ES256.
Times are Unix seconds. Write now or +1h, +30m, -5m, +7d for iat, nbf and exp, and they're turned into numbers when the token is signed. kid goes in the header and tells the verifier which key to use.
How to use this tool
- 1Write the claims as JSON, or pick an example.
- 2Choose the algorithm. For HS, type the secret; for RS, PS or ES, paste a PKCS#8 private key or use Generate a key pair.
- 3Copy the token from the right. With a generated key pair, the public key to verify with is shown under it.
- 4Paste the token into the JWT decoder to read it back.
Troubleshooting
- The key is in the older PKCS#1 or SEC1 format
- Keys starting with BEGIN RSA PRIVATE KEY or BEGIN EC PRIVATE KEY need converting:
openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem. - This key can't sign ES256
- ES256 needs an EC key on curve P-256, ES384 on P-384 and ES512 on P-521; RS and PS need an RSA key.
- The server says the signature is invalid
- Check the algorithm and secret match the server's exactly, including whitespace, and that the server doesn't expect the secret Base64-decoded.
Frequently asked questions
Is my secret or key sent anywhere?
No. Signing uses your browser's Web Crypto, and the secret and key are never put in share links or saved.
Can I use these tokens in production?
Use them for testing. A production signing key shouldn't be pasted into any website, this one included.
Can testingapis.com test my API with a token?
Yes: API tests can send a bearer token from an environment's secrets with every request.