win-j logo
Personal Tech Blog

Developer Utility

JWT Generator

Enter Header, Payload, and Secret values to generate an HS256 JWT token and inspect its Header, Payload, and Signature structure at a glance.

Create JWT Enter Header and Payload JSON to generate a test JWT token.
HS256 Support Supports the HMAC SHA-256 signing method commonly used in development testing.
Token Structure Check the generated token separated into Header, Payload, and Signature sections.
Algorithm HS256
Header Waiting
Payload Waiting
Secret Waiting

JWT Input

Enter Header JSON, Payload JSON, and Secret Key, then generate a JWT.

Security Notice

This page creates development-only HS256 signatures. Never enter production secrets or admin tokens, and remember that JWT Payload data is encoded, not encrypted.

Header waiting
Payload waiting
Secret waiting

RFC 7518 requires an HS256 key of at least 32 bytes. Generate and store production keys in a secure server-side secret manager.

Common Payload Claims
  • sub: User or subject identifier
  • name: User name or display name
  • iat: Token issued time
  • exp: Token expiration time
Warning

JWT Payload can be easily decoded, so avoid including sensitive values such as passwords, resident numbers, or API keys.

Generated Result

Check the generated JWT token and its Header, Payload, and Signature structure.

Ready 
JWT generation result will appear here.
Header 
-
Payload 
-
Signature 
-
Practical guide

Inspect HS256 JWT signatures without confusing them with encryption

Create a development JWT from JSON header and payload objects and a test secret. The payload stays readable; the signature does not hide its contents.

Prepared & reviewed by
win-j
Last reviewed
2026-10-01

Who this helps

  • Developers preparing local API fixtures
  • Learners inspecting JWT segments

When to use this tool

  • Generate an HS256 test token.
  • Compare UTF-8 JSON and Base64url segments.

From input to a checked result

  1. 1

    Use an HS256 header object and a payload object.

  2. 2

    Enter public test claims only.

  3. 3

    Use whole Unix seconds for exp, nbf and iat in this tool.

  4. 4

    Generate a random test secret or enter at least 32 UTF-8 bytes.

  5. 5

    Generate, inspect the three segments and validate the token in your target application.

Example 1

Unicode claim

Input
Header {"alg":"HS256"}; payload {"name":"テスト😀"}; random test secret
Result
Three Base64url segments; decoding the payload preserves the Unicode text.

Signing uses the UTF-8 text entered as the secret, without automatic hex decoding.

Example 2

A changed input

Input
Generate a token, then edit the payload or clear the form
Result
The previous token is invalidated and cannot return after an older pending signature completes.

Generate again for the new input.

How it works

Header and payload JSON are UTF-8 encoded, Base64url encoded and joined with a dot. Web Crypto HMAC-SHA-256 signs that string. A random secret is 32 random bytes shown as 64 hex characters; the displayed text is used as the key.

Limitations

  • Only HS256 is supported; critical header extensions and unencoded payloads are rejected.
  • The UI requires integer NumericDate values, a stricter input rule than the RFC's general numeric definition.
  • No issuer, audience, expiry, authorization or revocation policy is verified.
  • Secret length alone does not establish unpredictability. Use the random control for a test key.
Your data

JSON and keys are processed locally. Do not enter production keys or sensitive claims; tokens and copied output remain readable.

Related tools

  • Hash Generator

    Enter text to generate MD5, SHA-1, SHA-256, and SHA-512 hash values directly in your browser. The input is processed locally and is not sent to the server.

  • UUID v1/v4 Compare Generator

    Generate UUID v1 and UUID v4 at the same time and compare the differences between time-based and random-based UUIDs.

Frequently asked questions

Does the tool encrypt the payload?

No. Anyone with the token can decode the header and payload.

Is an expired token rejected here?

The generator checks input form, not the current validity of an application's claims.

Must I decode the random secret from hex on the server?

No. For this output, use the same displayed string as UTF-8 bytes. Hex decoding would use a different key.