JWT Creator (HS256)
Create a properly signed HS256 JWT: iat/exp set from the chosen lifetime, optional iss/sub claims, URL-safe base64 — the exact token format your API middleware validates. Built for generating test tokens during development; never use with a production secret.
Worked examples
Simple admin token
GET /api/v1/dev/jwt-create?payload=%7B%22role%22%3A%20%22admin%22%7D&secret=test-secret&expiresInSeconds=3600
Result: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3OTI2MDk5ODIsImV4cCI6MTc5MjYxMzU4Mn0.p-iX7G8xceCIWNyrPMmkn5ZPHP9dz9Tx9K1wi-CZjW4
With issuer + subject
GET /api/v1/dev/jwt-create?payload=%7B%22scope%22%3A%20%22read%22%7D&secret=another-secret&issuer=my-app&subject=user-42
Result: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6InJlYWQiLCJpYXQiOjE3OTI2MDk5ODIsImV4cCI6MTc5MjYxMzU4MiwiaXNzIjoibXktYXBwIiwic3ViIjoidXNlci00MiJ9.nB7b7hHrOwDgGTQsuLw9RAQTPlsfqs3kSCNqQHCgC7Q
Short-lived (5 min)
GET /api/v1/dev/jwt-create?payload=%7B%22purpose%22%3A%20%22magic-link%22%7D&secret=test-secret&expiresInSeconds=300
Result: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdXJwb3NlIjoibWFnaWMtbGluayIsImlhdCI6MTc5MjYwOTk4MiwiZXhwIjoxNzkyNjEwMjgyfQ.wWuvO05r5OSTdATCGMRX_j6bx7pb9ezcchdSZaONTzo
Machine API (x402)
$0.01 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/dev/jwt-create?payload=%7B%22role%22%3A%20%22admin%22%7D&secret=test-secret&expiresInSeconds=3600 HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "dev/jwt-create",
"input": {"payload":"{\"role\": \"admin\"}","secret":"test-secret","expiresInSeconds":3600},
"result": { "value": 148, "answer": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3OTI2MDk5ODIsImV4cCI6MTc5MjYxMzU4Mn0.p-iX7G8xceCIWNyrPMmkn5ZPHP9dz9Tx9K1wi-CZjW4" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Generates correctly signed HS256 test tokens: iat/exp computed from your chosen lifetime, optional iss/sub, proper URL-safe base64 — verified against the same math the decoder tool parses. For development fixtures and integration tests, NOT for production credentials.
token = b64url(header) + '.' + b64url(claims) + '.' + b64url(HMAC-SHA256(secret, header.claims))
Frequently asked questions
Is it safe to paste a real secret?
The secret is used in one in-memory HMAC computation and never stored — but this is a public API: generate test-token secrets only, never your production signing key.
Why HS256 only?
HS256 (shared-secret HMAC) covers the overwhelming majority of test-token needs and runs on Web Crypto. RS256/ES256 require key files — not something to paste into an API call.