JWT Generator and Decoder

📖 Overview

A JSON Web Token is three Base64URL segments joined by dots: a header naming the algorithm, a payload carrying your claims, and a signature that makes tampering detectable. Because the payload is only encoded and not encrypted, anybody holding the token can read it, which is the single most useful thing to remember when deciding what to put inside one. Debugging an API usually means one of two jobs. Either you need to knock together a token with particular claims and an expiry so you can call your own service, or you have a token from production and want to know what is actually inside it, whether it has expired, and whether the signature holds up. This tool puts both jobs on one page behind a tab. In generate mode you supply a JSON payload and a secret, optionally let it stamp the issued-at and expiry claims, and it signs with HMAC through the browser native Web Crypto interface. In decode mode it splits the three segments back into readable JSON, verifies the signature if you supply the secret, and shows the contents either way. Everything happens locally, so no token or secret leaves the browser, and nothing is logged or cached anywhere.

✨ Features

• Two modes behind a tab switch, generate and decode, sharing one result area so you never lose your place
• Three signing algorithms: HS256, HS384 and HS512, backed by SHA-256, SHA-384 and SHA-512
• Generate mode can stamp the issued-at and expiry claims automatically; you just enter a lifetime in seconds
• Decode mode restores the header and payload as formatted JSON and tells you whether the token has expired
• Supply the secret and the signature is verified automatically, with a clear match or mismatch verdict
• Results are shown as three separate blocks for header, payload and signature, so a long token stays readable

🚀 How to use

1. Use the tabs at the top to choose generate or decode
2. In generate mode, fill in the JSON payload, pick an algorithm and enter the secret, plus a lifetime in seconds if you want an expiry
3. In decode mode, paste the complete token; the secret is optional
4. Press Run and read the three segments laid out separately in the result area
5. The panel on the right shows the algorithm, expiry time, issue time and the number of custom claims

⚠️ Notes

• HMAC only: asymmetric algorithms such as RS256 need a private key and cannot be done safely in a pure front end, so this tool does not offer them
• HTTPS is required: signing depends on Web Crypto, and opening the page over http shows a not-supported message
• Verification needs the right secret: with the secret left blank the tool only decodes and deliberately gives no verdict on the signature
• Do not paste production secrets: nothing is uploaded, but on a shared machine reload the page when you are done
• Empty input gives no result: a blank payload or token prompts you to enter one, and malformed input produces a specific reason rather than a silent failure, so a token that merely looks wrong always tells you which segment is at fault