Generating test JWT tokens locally

Integration tests and frontend mocks often need a valid-looking JWT before your real identity provider is wired up. The shape is standardized: header (algorithm), payload (claims), signature (HMAC or asymmetric). For local work, HS256 with a shared test secret is common.

Minimum claims for testing

Claim	Purpose
sub	Subject — fake user id
iat	Issued at (Unix seconds)
exp	Expiry — reject stale tokens in your mock middleware
iss / aud	Optional — match what your API validates

Your mock API should still verify signature and exp, even in dev — otherwise you are not testing auth at all.

HS256 in the browser

HMAC-SHA256 signing fits Web Crypto (crypto.subtle.sign). The secret and payload never need to leave the tab if the tool runs client-side. That matters when the “test secret” is reused across staging environments.

Do not use online JWT generators for production keys or real user sessions.

Generator vs debugger

• Generator — quick tokens with preset lifetime and standard claims.
• Debugger — paste an existing token to inspect header/payload or craft custom JSON.

Use the JWT Generator for fast HS256 test tokens and the JWT Debugger to decode or build custom payloads.

Related reading

• Reading a JWT without trusting the server
• Unix timestamps: seconds vs milliseconds — iat and exp use seconds
• Generating passwords and tokens in the browser