JWT Generator

How to use the JWT Generator tool

1. Edit the Header JSON if needed. It defaults to {"alg":"HS256","typ":"JWT"}; the tool signs with the alg in the header, so HS384 and HS512 also work, but RS256 and other key-pair algorithms do not.
2. Edit the Payload JSON with your claims, such as sub, name, iat and exp. Click Upload Payload to load claims from a .json file, or Dummy Data for a sample.
3. Type the signing secret into the Secret Key field.
4. Click Sign & Generate Token. The token appears in the output panel as three dot-separated parts: header, payload and signature.
5. Click Copy to copy the token, then paste it into an Authorization: Bearer header to test your API. Clear resets everything.

How to create a signed JWT (HS256) in JavaScript, PHP and Python

const { createHmac } = require("node:crypto");

// HS256 token with no dependencies
function signHS256(payload, secret) {
  const b64url = (obj) => Buffer.from(JSON.stringify(obj)).toString("base64url");
  const header = b64url({ alg: "HS256", typ: "JWT" });
  const body = b64url(payload);
  const signature = createHmac("sha256", secret).update(`${header}.${body}`).digest("base64url");
  return `${header}.${body}.${signature}`;
}

const now = Math.floor(Date.now() / 1000);
const token = signHS256(
  { sub: "1234567890", name: "John Doe", iat: now, exp: now + 3600 },
  "your-256-bit-secret"
);
console.log(token);

// With the jsonwebtoken package (npm i jsonwebtoken):
// const jwt = require("jsonwebtoken");
// jwt.sign({ sub: "1234567890", name: "John Doe" }, "your-256-bit-secret", { expiresIn: "1h" });

<?php
// composer require firebase/php-jwt
require 'vendor/autoload.php';

use Firebase\JWT\JWT;

$payload = [
    'sub'  => '1234567890',
    'name' => 'John Doe',
    'iat'  => time(),
    'exp'  => time() + 3600,
];

$token = JWT::encode($payload, 'your-256-bit-secret', 'HS256');
echo $token, PHP_EOL;

# pip install PyJWT
import time
import jwt

payload = {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600,
}

token = jwt.encode(payload, "your-256-bit-secret", algorithm="HS256")
print(token)

Common errors and how to fix them

Error: Invalid JSON in Header or Payload

The JSON has a trailing comma, single quotes or an unquoted key. Fix it in the editor; both boxes must contain strict JSON objects.

JsonWebTokenError: invalid signature when my API verifies the token

The API uses a different secret, or expects RS256 with a public key. Check the secret byte for byte, including whether the server Base64-decodes it before use (Auth0 style).

TokenExpiredError: jwt expired right after generating

exp must be a Unix timestamp in seconds, not milliseconds, and later than now. Date.now() returns milliseconds; divide by 1000.

Error: secretOrPrivateKey must have a value

The secret was undefined because an environment variable was not loaded. Log its length (never its value) at startup to catch this early.

The API rejects the token but this tool decodes it fine

Decoding only reads the payload. Verification also checks exp, nbf, iss and aud claims, so a missing or wrong aud fails even with a valid signature.

Good to know