PgArachne JWT Signer

⚠ Handle your JWT secret with care

JWT_SECRET is the master key of your API: anyone who knows it can sign a token for any database role, including superusers.
Do not paste a production secret into a web page you do not fully control. Use this tool with development / test secrets only. For production, save this file and open it locally (it works offline), or sign tokens on the server.
Everything runs in your browser. The page forbids all network access (Content Security Policy connect-src 'none'), loads nothing external, and never stores the secret — not in localStorage, cookies, or the URL. It disappears when you close or reload the tab.
A token signed here is accepted by PgArachne exactly like one issued by /token, including its role and lifetime. Keep lifetimes short and never share tokens signed with a real secret.

Secret & Claims

JWT secret (JWT_SECRET)

Used only to compute the HS256 signature in this tab. Not saved anywhere.

Database role (db_role)

Database (db_name)

Valid for

A negative value produces an already expired token — handy for testing how your client handles 401s.

Issuer (iss), optional

Audience (aud), optional

Only needed if the server is configured to require them.

Extra claims (JSON object), optional