100% Client-SideGenerators

Online JWT Generator & Mock Token Builder (Zero-Upload Privacy)

Create, configure, and cryptographically sign JSON Web Tokens (JWT) directly inside your browser. Generate mock authorization tokens for local backend APIs, Postman integration testing, and microservice debugging with zero server upload.

JWT Generator & Signer

Preset Templates:

Signing Algorithm

Secret Encoding

Secret Key / Private Key (PEM)

Set Expiration (exp):

Header (Algorithm & Typ)

HS256

Payload (Claims JSON)

JSON Claims

Shareable URL Link

URL sharing encodes your generator state into the URL hash (#). Opt-in only to protect credentials.

Encode state in URL hash (#) for sharing

Loading workspace...

#How to Use This Tool

1Select a token preset (Standard Bearer, OAuth2 / OIDC, Hasura GraphQL, or Supabase Mock) or edit the JSON payload directly.

2Use the quick expiration buttons (+15m, +1h, +24h, +7d) to automatically compute and synchronize the Unix "exp" and "iat" claims.

3Choose your signing algorithm (HS256 for shared secrets, RS256 for RSA private keys, or "none" for unsigned debug tokens).

4Enter your secret key or click "Generate Ephemeral Keypair" to create a temporary RSA test key pair in your browser.

5Copy the generated token, authorization header, or sample curl command directly into your terminal or API client.

#Mathematical Formula & Standards

JWT generation constructs an RFC 7519 token by concatenating Base64URL(Header) + "." + Base64URL(Payload) + "." + Base64URL(Signature). The Header declares the algorithm (e.g. HS256, RS256) and type (JWT). The Payload carries Unix timestamps (iat, exp, nbf) and custom identity claims. Under JWS (RFC 7515), HMAC-SHA (HS256) signs the input using a symmetric secret, while RS256 signs using an asymmetric RSA private key via the browser Web Crypto API (crypto.subtle.sign).

#Edge Cases & Technical Considerations

Unsigned Debug Tokens (alg: "none")

Tokens with alg "none" omit the cryptographic signature segment. They are suitable exclusively for local offline mock tests and must never be permitted in production environments where signature validation is mandatory.

Unix Epoch Expiration (Seconds vs Milliseconds)

RFC 7519 strictly mandates that exp, iat, and nbf claims are measured in integer seconds since January 1, 1970 (Unix epoch). Passing millisecond timestamps (e.g. Date.now()) causes tokens to remain valid for tens of thousands of years or triggers immediate parsing errors.

HMAC Secret Key Length & Entropy

For HS256, NIST guidelines recommend shared secrets with at least 256 bits (32 bytes) of entropy. Short or weak dictionary secrets leave tokens vulnerable to offline dictionary and brute-force attacks.

Ephemeral Keypair Safety

Our ephemeral RSA keypair generator creates disposable 2048-bit keys directly in your browser memory via Web Crypto API. These keys are never persisted or uploaded, making them ideal for quick backend development without managing permanent secrets.

#Frequently Asked Questions

Q:Are secret keys or generated JWTs uploaded to your servers?

Never. regula.tools executes 100% on your device using the browser native Web Crypto API (crypto.subtle). No keys, payload data, or tokens ever leave your browser.

Q:Can I use this generated token in Postman or curl?

Yes. The workspace provides dedicated one-click buttons to copy the raw token, the "Authorization: Bearer <token>" header, and a full curl command template.

Q:How do the quick expiration buttons work?

Clicking any expiration button calculates current Unix time plus the chosen duration and automatically updates the "iat" (issued at) and "exp" (expiration) claims in the payload JSON editor.

Have feedback or feature requests?

Help us improve this utility. Share suggestions, report edge cases, or request new features directly.

Send Feedback

#Related Utilities

Explore complementary tools running on-device with zero server upload.

Converters

JWT Decoder & Inspector — Zero-Upload Online JWT Token Viewer

Decode, inspect, and verify JSON Web Tokens (JWT) directly inside your browser. No auth tokens or secret keys are ever transmitted over the network or logged to cloud servers, satisfying strict enterprise privacy, SOC2, and GDPR Article 28 compliance.

Open Utility

Generators

Cryptographic Password Generator — Secure & Client-Side

Engineered to meet NIST SP 800-63B standards, this utility leverages your browser’s cryptographically secure pseudo-random number generator (window.crypto.getRandomValues). All credentials are generated strictly in memory and are never persisted in cookies, local storage, or transmitted across the network.

Open Utility

Generators

UUID Generator — Online Bulk RFC 4122 v4 & RFC 9562 v7 GUIDs

Generate RFC 4122 Version 4 random UUIDs and modern RFC 9562 Version 7 timestamp-ordered UUIDs instantly. All values are generated locally on your device via the Web Crypto API. Tokens are never transmitted to remote servers.

Open Utility

← Back to Generators Hub Return to Catalog ↑