JWT Signer & Key Generator

Testing authentication often requires tokens with exact claims: an admin role, a specific tenant, a short expiry or a missing scope. The JWT Signer lets you edit the header and payload, generate a strong secret key and sign the token, all in the browser, so you can test API behaviour without writing scripts or using a real identity provider.

How to use it

1. Generate a secret key, or paste the test secret your API uses.
2. Edit the payload claims, such as sub, role and exp.
3. Sign the token and copy it.
4. Call your API with Authorization: Bearer <token>.

Test scenarios worth covering

• Expired token: set exp to a past timestamp. The API should return 401.
• Wrong signature: sign with a different secret. The API must reject it.
• Insufficient permissions: remove the admin role. Protected endpoints should return 403.
• Wrong audience or issuer: change aud or iss. A correctly configured API rejects the token.
• Tampered payload: change a claim after signing without re-signing. Verification must fail.

Choosing a secret

For HMAC algorithms the secret should be random and at least as long as the hash output: 32 bytes for HS256, 48 for HS384 and 64 for HS512. A generated key such as a 64-character hex string is far stronger than a word or phrase, which attackers can crack offline from a single captured token.

Symmetric vs. asymmetric

HS256 uses one shared secret for signing and verification, which suits a single service. When several services must verify tokens issued by one authority, asymmetric algorithms such as RS256 or ES256 are better, because verifiers only need the public key.

Keys and tokens are generated locally. Use test keys only.