Tiny Online Tools
生成 & 解码 JWTs for Authentication Testing
JSON Web Tokens (JWTs) are the standard for API authentication and authorization. Whether you're building an auth system, testing token flows, or debugging authentication issues, you need a way to quickly 创建 and inspect JWTs without writing code.
This JWT Generator lets you 创建 tokens with custom headers and payloads, sign them with HMAC secrets, and instantly inspect any JWT by decoding it. Test your authentication before deploying, verify token structure without extra tools, and debug token-related issues faster.
生成 Custom JWTs
Define your token in three parts:
Header: Standard JWT header fields identifying the token type and hashing algorithm. Edit the JSON to customize if needed, though defaults work for most cases.
Payload: The actual token data—user ID, claims, roles, expiration time, etc. Define whatever claims your application expects. The tool accepts any valid JSON.
Secret Key: The HMAC secret used to sign the token. This is crucial: use the same secret when validating tokens in your application. The tool never sends this anywhere—it stays in your 浏览器.
Click 生成, and you instantly get a valid, signed JWT ready to use in testing.
Three HMAC Algorithms Supported
HS256 (HMAC-SHA-256): The most common choice. Balances security and performance.
HS384 (HMAC-SHA-384): Stronger hashing for higher security requirements.
HS512 (HMAC-SHA-512): Maximum security with SHA-512 hashing.
Choose based on your application's security needs.
解码 Any JWT
Have a JWT from an API response or log? Paste it in the 解码 section and instantly see the 解码d header and payload. This is invaluable for:
- Inspecting API Responses: Extract the JWT from an authentication response and see what claims it contains
- Debugging Auth Issues: Check if a token has the expected user ID, roles, expiration time, etc.
- Verifying Token Structure: Ensure your auth server is issuing tokens with the correct 格式化
- Token Analysis: See at a glance what data a token carries
Note: Decoding doesn't verify the signature—it just extracts and displays the data. This is safe for inspection but doesn't prove the token is valid.
Color-Coded Token Display
When you 生成 a JWT, it's displayed with color coding showing the three segments:
- Header segment in one color
- Payload segment in another
- Signature segment in a third
This makes it easy to spot which part is which and understand the token structure.
Common Testing Scenarios
Auth Flow Testing: 生成 tokens with different payloads and test how your application handles them. 创建 tokens with various expiration times, roles, or user IDs without needing a full auth server.
Bearer Token Validation: 生成 a token, copy it, add it as a Bearer token to API requests, and verify your authorization middleware accepts it.
Token Claims Verification: Test that your application correctly extracts and uses claims from tokens by generating tokens with specific claim values and checking if your app processes them correctly.
Security Testing: 生成 tokens with expired timestamps or invalid signatures (by using different secrets) to test how your app handles invalid tokens.
100% 浏览器-Based, Completely Secure
All JWT generation and decoding happens in your 浏览器 using the native Web Crypto API. Your secrets never leave your machine, and your 生成d tokens aren't sent anywhere. This is safe for testing with production secret values—they never touch an external server.
Copy & Use Immediately
生成d JWTs copy with one click. Paste directly into API request headers or tool test fields without additional 格式化ting.