fordeer@jwt-gen:~

HS256 · RFC 7519

 _____              _
|  ___|__  _ __  __| | ___  ___ _ __
| |_ / _ \| '__|/ _` |/ _ \/ _ \ '__|
|  _| (_) | |  | (_| |  __/  __/ |
|_|  \___/|_|   \__,_|\___|\___|_|

[ok] client-side only · no data stored

[ok] Web Crypto API · HMAC-SHA256

[ok] session ready_

$ secret_key [required]

# key used to sign JWT · never share · default for local: your_secret_key

$ username [required]

# stored as sub + username in payload

$ custom_claims [optional]

# valid JSON merged into payload

$ expires_at [required]

# token invalid after this timestamp

$ cat ./token.jwt

$ man jwt-gen

security

UI runs in-browser. Secret key never leaves your machine.

crypto

Uses Web Crypto API for HMAC-SHA256 signing.

standard

RFC 7519 JWT · algorithm HS256.

compat

Works with any system that accepts standard JWT.

$ curl /api/generate-jwt

HS256 only. Pass your secret via X-Secret-Key (or fallback JWT_SECRET). Optional gate: GENERATE_API_KEY.

curl -X POST /api/generate-jwt \
  -H 'Content-Type: application/json' \
  -H 'X-Secret-Key: your_secret_key' \
  -d '{"username":"user@example.com","expiresInHours":24}'

$ cat ./token.jwt

$ verify --token