About this tool
jwtviewer.com decodes tokens; jwtparser makes them. Set your claims, choose an HMAC algorithm, type a secret, and the tool signs the token live with the Web Crypto API. Handy for testing an API that expects a bearer token, seeding auth in tests, or reproducing a bug with a specific exp or role.
Only HMAC (shared-secret) algorithms are supported — never sign a real production token here, and treat generated tokens as test-only. Everything happens locally; the secret and payload never leave your browser. To decode or verify a token, use jwtviewer.com.
Signing follows RFC 7519: the tool builds the header {"alg":…,"typ":"JWT"}, Base64url-encodes header and payload, then computes an HMAC-SHA signature over header.payload with your secret using the Web Crypto API. HS384 and HS512 simply use longer hashes than HS256 — pick whatever your backend expects. Time claims like exp, iat and nbf are Unix seconds, which is why the quick-add chips compute them for you. The three parts of the output are color-coded so you can see exactly where the header, payload and signature begin.
Frequently asked questions
Can this tool create RS256 tokens?
No — only the HMAC family (HS256, HS384, HS512), which signs with a shared secret. RS256 needs an RSA private key. For test scenarios HMAC is usually enough; to decode or verify any token, use jwtviewer.com.
Is it safe to type a secret here?
Signing happens entirely in your browser with the Web Crypto API — the secret and payload are never uploaded. Even so, best practice is to use throwaway test secrets here and never a real production signing key.
How do I set the token expiration?
The exp claim is a Unix timestamp in seconds. Click one of the quick-add chips — exp = +1h, +1d or +7d — or type a value yourself; the token re-signs instantly on every change.
Why does my API reject the generated token?
The usual causes: the secret does not match the server’s, the algorithm differs from what the backend expects, exp is already in the past, or the server requires an asymmetric algorithm like RS256. Decode the token on jwtviewer.com to compare its claims.