Question 1

Why can it sign HMAC but not RS256?

Accepted Answer

Because signing RS256 or ES256 needs the private key, and pasting a production private key into a web page is a bad habit regardless of how the page behaves. HMAC uses one shared secret that you already have on both sides, so nothing is exposed that was not already. If you need an RS256 token, mint it where the private key lives; you can still bring the result here and verify it with the public key in the decoder.

Question 2

How long should the signing secret be?

Accepted Answer

RFC 7518 section 3.2 says an HMAC key must be at least as long as the hash output: 32 bytes for HS256, 48 for HS384, 64 for HS512. Below that the tool warns you, and the reason is concrete. Anyone holding one of your tokens can try candidate secrets offline as fast as their hardware allows, and a short or dictionary-based one falls quickly. Once it does, they mint their own tokens with any claims they like.

Question 3

Can I use these tokens in production?

Accepted Answer

For testing your own services, yes; that is what it is for. As a way of issuing real user sessions, no. A real issuer needs key rotation, revocation, an audience per service and a way to keep the secret out of anyone's clipboard, none of which a page like this provides.

Question 4

Why does the token change when I have not touched the claims?

Accepted Answer

Because iat and exp are recomputed from the current second every time the token is rebuilt, so two tokens made a second apart differ in the payload and therefore in the signature. If you want a byte-identical token, set the lifetime to "No exp claim", untick iat, and write both values into the claims box yourself.

Question 5

How do I set an exact expiry rather than a duration?

Accepted Answer

Set the lifetime to "No exp claim" and put your own exp in the claims box as seconds since 1970. The duration picker only ever adds exp when it is set, so your value survives untouched. The same goes for iat once you untick the box.

Question 6

What is the key id field for?

Accepted Answer

It writes a kid into the header. Issuers that rotate keys publish several at once and use kid to tell the verifier which one to reach for, so if the service you are testing looks the key up by kid, its token needs one. Leave it empty and the header is just alg and typ.

Question 7

How do I test that my API rejects an expired token?

Accepted Answer

Choose "Already expired" as the lifetime. You get a token whose exp fell five minutes ago, with iat backdated an hour before that so it looks like one that lived a normal life rather than one issued after it expired. Five minutes is far enough past to clear the clock skew allowance most verifiers apply, which is usually thirty to sixty seconds, so a service that still accepts it is genuinely not checking exp.

tooldura

JWT Generator

About JWT Generator

How to use JWT Generator

Frequently Asked Questions