Sign a test JWT for local development

Your API expects a signed token but the auth server is not running. Build an HS256 JWT locally with the claims you need.

Tools used in this guide

The job

Testing a protected endpoint needs a token whose signature your API accepts — for a shared-secret HS256 setup, that means HMAC-SHA256 over a JSON payload. Building it by hand is error-prone base64url juggling.

Sign one

Paste the payload JSON ({"sub":"user-1","role":"admin"} style), enter the dev secret your API expects, and choose iat/exp claims if needed. The tool signs with WebCrypto and the token is ready to paste into an Authorization header.

Only HS256 is supported — keys are symmetric secrets, not RSA pairs.
The header defaults to {"alg":"HS256","typ":"JWT"}; override only if your stack needs extra fields like kid.

Worked example

Payload {"sub":"42","exp":...} + secret "dev-secret" produces a three-part token your dev API accepts. Decode it with the JWT decoder to confirm the claims landed where the middleware expects them.

Security notes

Use throwaway secrets — anyone who holds the secret can forge tokens, so never reuse a production secret here. Verification of an existing token is also local: the secret is compared in-browser.

Limits: payload/header JSON up to 100 KB, secret up to 1,024 characters.
Nothing is sent anywhere — signing happens with crypto.subtle.