JWT Generator

Generated tokens are useful for exercising your verification path: checking that your API rejects an expired token, that it validates aud, that a missing role produces a 403 rather than a 500. Building those cases by hand against a live authorization server is slow and hard to control.

What they are not for is production. A token you sign here is only as trustworthy as the secret you typed into a web page. Use your real authorization server for anything that matters.

HS256 uses one shared secret to both sign and verify. Simple, but every party that can verify can also mint — so it only works when issuer and verifier are the same trust domain. Use a secret with real entropy; a short human-chosen string is brute-forceable offline once an attacker has a single token.

RS256 and ES256 sign with a private key and verify with the public one. This is what OAuth2 providers use, because verifiers only ever hold the public half and cannot forge tokens. ES256 produces noticeably smaller signatures than RS256, which matters if your tokens travel in headers.

At minimum iss, sub, aud, iat, and exp. Timestamps are seconds since epoch — the single most common mistake here is passing milliseconds, which produces a token valid for roughly fifty thousand years.

To test rejection paths, set exp in the past, set aud to a value your API doesn't accept, or omit a claim your code assumes is present. That last case catches a surprising number of crashes in code that reads claims without checking they exist.