Bearer Token Generator
Generate HS256-signed JWT bearer tokens with a custom payload — decoded preview, human-readable expiry, and security warnings.
About this ToolHow it works, benefits & use casesTap to collapse
Generate a bearer token online: this tool mints a signed, JWT-style token ready to paste into an Authorization: Bearer header while you test an API. Write any JSON payload — sub, iss, aud, scope, role, or your own custom claims — and the tool adds an iat (issued-at) timestamp, a random jti, and an exp expiry if you set one. Tokens are signed with HS256 (HMAC-SHA256) using a secret you provide, or you can pick "none" for an unsigned token. Signing happens entirely in your browser via the Web Crypto API, so the secret you type never leaves your machine. After generating, you see the token string, its expiry in human-readable form, and the fully decoded payload. A warnings panel flags weak or default secrets, unsigned tokens, missing expiry, and over-long lifetimes — the kinds of mistakes that are fine for a test fixture but dangerous in production.
How to Use
- 1Set "Expires in (seconds)" — for example 3600 for one hour, or 0 for a token that never expires.
- 2Choose the Algorithm: HS256 (HMAC-SHA256) to sign with your secret, or none for an unsigned token.
- 3Enter a Secret key (used only for HS256 signing) — it stays in your browser.
- 4Edit the Payload (JSON) with your claims, or click "Load example" for a sample sub/iss/aud/scope/role payload.
- 5Click "Generate token", then copy the token, read the human-readable expiry, review any security warnings, and inspect the decoded payload.
Key Benefits
- Signs HS256 (HMAC-SHA256) tokens entirely in the browser with the Web Crypto API
- Accepts any custom JSON payload; auto-adds iat, a random jti, and exp when an expiry is set
- Configurable expiry in seconds, including 0 for no expiry
- Shows the token, a human-readable time-to-expiry, and the decoded payload
- Security warnings for unsigned tokens, weak/default secrets, missing or very long expiry
- Optional unsigned "none" algorithm for testing scenarios that require it
- Your secret and payload never leave your machine — no server round-trip
Common Use Cases
- Crafting an access token to test a protected endpoint from curl, Postman or a test suite
- Generating a fixture token with specific claims (role, scope, sub) for integration tests
- Reproducing a token shape your backend expects while building a client
- Demonstrating JWT structure and expiry behaviour to a teammate learning auth
- Quickly producing a short-lived token to exercise expiry handling in your code
Test-only values.Tokens are signed client-side; any secret you type is not sent anywhere. Don't use these in production without proper key management.
Options
0 = no expiry
Used to sign the token when algorithm is HS256
Generated token will appear here.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related guide
Related tools
- JWT DecoderDecode and inspect JWT tokens
- Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512 hashes
- Changelog GeneratorGenerate changelog from Git commit history
- Component Name GeneratorTurn a description into ranked, kind-aware component names with a file scaffold and a name validator (casing, collisions, clarity)
- Heroku Procfile GeneratorBuild a Heroku Procfile and matching app.json — process types, env vars, addons, dyno formation — plus a Procfile parser and audit
- Markdown TOC GeneratorGenerate table of contents for Markdown
No — they are intended for testing. The tool itself warns about this: tokens are signed client-side, and using a default or weak secret, the unsigned "none" algorithm, or a token that never expires is dangerous in real systems. For production you need proper key management and a vetted server-side signing flow.
For testing, a generator like this one is the fastest route: set an expiry, pick HS256, and copy the token into your Authorization header. From a terminal, an opaque random token is one line — openssl rand -hex 32, or in Node, crypto.randomBytes(32).toString("base64url"). In production you never mint bearer tokens by hand: your authorization server (an OAuth 2.0 / OpenID Connect provider) issues them at login or through the client-credentials flow, signs them with managed keys, and keeps them short-lived.