diff --git a/auth-migration/src/test/java/com/example/auth/TestTokenUtil.java b/auth-migration/src/test/java/com/example/auth/TestTokenUtil.java
new file mode 100644
index 0000000..6ece8c4
--- /dev/null
+++ b/auth-migration/src/test/java/com/example/auth/TestTokenUtil.java
@@ -0,0 +1,71 @@
+package com.example.auth;
+
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import io.jsonwebtoken.security.Keys;
+
+import javax.crypto.SecretKey;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Test utility for generating JWT tokens with specific claims.
+ * Mirrors the token construction used in the legacy auth system.
+ */
+public final class TestTokenUtil {
+
+    private static final String SECRET = "auth-migration-test-secret-key-must-be-at-least-256-bits-long";
+    private static final SecretKey KEY = Keys.hmacShaKeyFor(SECRET.getBytes(StandardCharsets.UTF_8));
+
+    private TestTokenUtil() {}
+
+    public static String generateExpiredToken() {
+        return Jwts.builder()
+                .setSubject("user123")
+                .setExpiration(new Date(System.currentTimeMillis() - 60_000))
+                .signWith(KEY, SignatureAlgorithm.HS256)
+                .compact();
+    }
+
+    public static String generateTamperedToken() {
+        // Generate valid structure but sign with different key
+        SecretKey wrongKey = Keys.hmacShaKeyFor(
+                "wrong-key-for-tampering-test-must-be-256-bits-minimum".getBytes(StandardCharsets.UTF_8));
+        return Jwts.builder()
+                .setSubject("user123")
+                .setExpiration(new Date(System.currentTimeMillis() + 3_600_000))
+                .signWith(wrongKey, SignatureAlgorithm.HS256)
+                .compact();
+    }
+
+    public static String generateTokenWithoutSub() {
+        return Jwts.builder()
+                .setExpiration(new Date(System.currentTimeMillis() + 3_600_000))
+                .signWith(KEY, SignatureAlgorithm.HS256)
+                .compact();
+    }
+
+    public static String generateTokenWithRole(String role) {
+        return Jwts.builder()
+                .setSubject("user123")
+                .claim("roles", List.of(role))
+                .setExpiration(new Date(System.currentTimeMillis() + 3_600_000))
+                .signWith(KEY, SignatureAlgorithm.HS256)
+                .compact();
+    }
+
+    public static String generateAdminToken() {
+        return generateTokenWithRole("ROLE_ADMIN");
+    }
+
+    public static String generateValidToken() {
+        return Jwts.builder()
+                .setSubject("user123")
+                .claim("roles", List.of("ROLE_USER"))
+                .setExpiration(new Date(System.currentTimeMillis() + 3_600_000))
+                .signWith(KEY, SignatureAlgorithm.HS256)
+                .compact();
+    }
+}