Can I decode this token to see a header and payload?

You can run it through a base64url decoder, but the result won't be readable JSON. Unlike a real JWT, this generator produces random bytes for every segment rather than JSON-encoding a header and claims first — it matches a JWT's outward shape, not its internal structure.

Is this safe to use in a UI demo or screenshot?

Yes — that's exactly what it's for. It looks like a real token at a glance without containing any real signature, claim or credential, so it's safe to paste into a mockup, a demo environment or documentation.

JWT Sample Generator

Generates a clearly-fake JWT-shaped string — three dot-separated segments of random bytes, with no real header JSON, claims or signature behind them — for filling in UI mockups or documentation. Never a valid, verifiable, decodable or usable authentication token.

Your result will appear here.

What this generator does

Produces a JSON Web Token-shaped string — three base64url segments separated by dots, of length 10, 20 and 24 raw bytes — for testing parsers, log redaction and UI truncation.

How to use this tool

Press generate for a sample token.
Generate again for another one.

Worked examples

Format: F2R2MOcyp1lbPA.SDjH1wP8F-SLajoYVE28xCD9I_w.ztemi-36jvqW_apmObDp2K8hzxsdTHTM — three dot-separated base64url segments matching a real JWT's shape and rough proportions.

Common use cases

UI mockups needing a token-shaped value
Documentation examples
Teaching JWT structure

How this generator works

Each of the three segments is a separate run of random bytes from your browser's Web Crypto generator — 10 bytes, 20 bytes and 24 bytes respectively — encoded as base64url and joined with dots. Unlike a real JWT, the first two segments are not JSON encoded before being converted: they are random bytes straight to base64url, so decoding the 'header' segment will not produce readable JSON such as {"alg":"HS256"}. This tool matches a JWT's outward shape (three dot-separated base64url parts of a plausible length), not its internal structure.

Randomness and fairness

All three segments are independent runs of your browser's cryptographic random generator, with no shared state between them and no seeded mode.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

The signature is not a real signature over the payload, so the token will fail verification against any key. It is a shape for testing, never a credential.
The header and payload segments are random bytes, not encoded JSON — decoding them will not reveal an algorithm name or claims the way a real token's would. Use the JWT decoder on an actual token to see genuine header and claim structure.

A structural example only — has no real signature or claims, and is never a valid, verifiable or usable authentication token.

Frequently asked questions

Can I decode this token to see a header and payload?: You can run it through a base64url decoder, but the result won't be readable JSON. Unlike a real JWT, this generator produces random bytes for every segment rather than JSON-encoding a header and claims first — it matches a JWT's outward shape, not its internal structure.
Is this safe to use in a UI demo or screenshot?: Yes — that's exactly what it's for. It looks like a real token at a glance without containing any real signature, claim or credential, so it's safe to paste into a mockup, a demo environment or documentation.