What goes into the token
A JWT is three Base64Url parts joined by dots: a header (alg, optional kid, typ), a payload of claims, and a signature over the first two. The generator writes the header in the same order as .NET's JsonWebTokenHandler and keeps your custom claims exactly as typed, so 1.0 stays 1.0 and big numbers are not rounded.
- iss and aud must match
ValidIssuerandValidAudienceexactly (case-sensitive). Several audiences become a JSON array, andValidAudiencesin the code. - exp, nbf and iat are Unix seconds. JwtBearer requires
expby default and allows 5 minutes ofClockSkewon both ends. - sub becomes
ClaimTypes.NameIdentifierand roles becomesClaimTypes.Role(becauseMapInboundClaimsis on), soUser.IsInRole("admin")works without extra setup. - name is not mapped, which is why the code sets
NameClaimType = "name": otherwiseUser.Identity.Nameis null.
Calling your API with the token
Send it in the Authorization header. The "Call the API" tab has the curl command; in Swagger UI, click Authorize and paste the token (without "Bearer" when the scheme is http/bearer); in a Visual Studio .http file:
GET https://localhost:5001/me
Authorization: Bearer eyJhbGciOi...A 401 with a WWW-Authenticate: Bearer error="invalid_token" header means JwtBearer rejected the token; paste it into the JWT decoder with your settings to see which check failed and the exact IDX error.
HS256, RS256 or ES256?
HS256/384/512 use one shared secret: whoever can validate a token can also create one. That is fine when one app issues and checks its own tokens. The secret must be at least as long as the hash: 32 bytes for HS256, 48 for HS384, 64 for HS512. RS256 and ES256 sign with a private key and validate with the public key, so an API only ever holds a key that cannot issue tokens; identity providers (Entra ID, Auth0, Keycloak, Duende) use them. ES256 keys and signatures are much smaller than RSA's.
Other ways to get a test token
For local development, the .NET SDK has dotnet user-jwts create: it issues a token for the current project and writes the matching settings into appsettings.Development.json and user secrets. Use this page when you need a token your own TokenValidationParameters accept, custom claims, an RSA or EC key, an expired token to test error handling, or a token for a non-.NET client. In integration tests, create tokens in code with JsonWebTokenHandler (the "Create it in C#" tab) and the same key your test host uses.
FAQ
How do I create a JWT to test an ASP.NET Core API?
Sign a token with the key, issuer and audience your AddJwtBearer setup expects, then send it as Authorization: Bearer <token>. This page does exactly that and prints the matching TokenValidationParameters; for local development, dotnet user-jwts create is the SDK's built-in alternative.
How long must an HS256 secret be?
At least 32 bytes (256 bits) for HS256, 48 for HS384, and 64 for HS512. .NET refuses shorter keys: creating a token throws IDX10720 (IDX10653 below 16 bytes), and JwtBearer rejects it with a 401 and IDX10517.
Should I use HS256 or RS256?
HS256 uses one shared secret, so anything that can validate a token can also create one, which is fine when a single app issues and checks its own tokens. RS256 and ES256 sign with a private key and validate with a public key, so an API never holds a key that could issue tokens. Identity providers use RS256; ES256 keys and signatures are smaller than RSA's.
How do I create a JWT in C#?
Use JsonWebTokenHandler from Microsoft.IdentityModel.JsonWebTokens: build SigningCredentials from a SymmetricSecurityKey, RsaSecurityKey or ECDsaSecurityKey, then call CreateToken with a SecurityTokenDescriptor or a JSON payload. The "Create it in C#" tab has a full program that prints the same token as this page.
Why does JwtBearer reject a token without exp?
RequireExpirationTime is true by default, so a token without an exp claim fails with IDX10225. Add exp to the token, or set RequireExpirationTime to false in tests.
Is it safe to generate JWTs online?
This page signs tokens with your browser's WebCrypto; nothing is sent anywhere and keys are never saved. Still, use test keys only. A production signing key should never be pasted into any web page.