Build a test JWT locally
Local auth tests need a token with known claims. Set the header and payload, enter an HS256 secret, and generate. The signature is created with Web Crypto in this tab.
This page does not explain JWT from scratch. That lives on the JWT Decoder. The standard is RFC 7519.
Claims that matter: iss, aud, exp, iat
iss and aud should match what your API checks. iat is issued-at. exp is expiry, in seconds, not milliseconds. Use the datetime control to write exp without doing the math by hand.
Clock skew is real. If a token is “not yet valid”, check nbf and whether your machine clock is off.
HS256 secrets stay in the browser
The secret is used only to sign. It is not stored and not added to the decoder URL. Treat even a local secret as something you would not paste into a screenshot.
How this pairs with the JWT Decoder
Generate, copy the token, open the decoder, paste. Verify with the same secret there. If verification fails, you usually have a seconds-vs-milliseconds exp or a trimmed token.
What this generator will not sign
No RS256, no ES256, no JWKS lookup. Unsigned alg none exists only so you can prove your API rejects it.
How to use
- Load Sample or edit the header and payload.
- Set exp if you need a specific expiry.
- Generate token, copy it, then open the JWT Decoder.
Privacy
Signing is local. The secret is not persisted.
Frequently Asked Questions
Which algorithms can I sign with?
HS256 only, using Web Crypto in the browser. RS256 and ES256 are not implemented because private-key handling is easy to get wrong on a public page.
Why is alg none offered?
Only as a negative test. Unsigned tokens should be rejected by a real API. The control is labeled as dangerous on purpose.
Are exp values in seconds or milliseconds?
Seconds, as RFC 7519 requires. The datetime picker writes Unix seconds. A 13-digit millisecond value will look like a date far in the future.
Does Open JWT Decoder send the secret?
No. The link is a normal navigation. Paste the token yourself. The secret never goes in the query string or hash.
Is the secret stored?
No. It lives in React state for the tab. It is not written to localStorage.