JWT Debugger

Generate & Sign a JSON Web Token

Edit the header and payload, choose a signing algorithm, set an expiry, and sign a JWT with your own key — entirely in your browser.

Configuration

Header, payload claims & expiry
ALG
Header
Payload
Token Expiry (exp)
Optional

Sign & Output

Sign key & real-time generated JWT
Signature Key
HMAC secret
Encoded Token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
Signature Idle

Frequently asked questions

Edit the payload with the claims you need, pick a signing algorithm, and enter the secret or private key to sign with. The signed token is produced immediately and updates as you type — copy it from the Encoded Token panel when you are done.

RFC 7518 requires a key of at least the hash output size, so HS256 needs 256 bits (32 bytes) of entropy, HS384 needs 384, and HS512 needs 512. Short, human-memorable secrets are brute-forceable offline by anyone holding a token — generate them randomly.

Both take PEM-encoded keys: a PKCS#8 private key for signing (the "BEGIN PRIVATE KEY" block) and a SPKI public key for verification (the "BEGIN PUBLIC KEY" block). ES256 specifically requires a P-256 curve key — a P-384 key will fail with an algorithm mismatch.

No. A signed JWT is encoded, not encrypted — anyone holding the token can read every claim without any key. Signing protects against tampering, not disclosure. Keep secrets, passwords, and personal data out of the payload entirely.

Use the expiry selector to pick a preset duration or an exact date and time; it writes the "exp" claim as a Unix timestamp into the payload. Short lifetimes limit the damage if a token leaks, so prefer minutes or hours over days for access tokens.