JWT Generator & Decoder
Generate synthetic HS256 JWTs or decode JWT header and payload sections locally in your browser.
Minimum 16 characters. This secret is used only in the current browser session to sign a synthetic HS256 token.
Optional JSON object only. Reserved claims controlled above cannot be overridden by custom claims.
What is a JWT?
A JSON Web Token is a compact token format commonly used to carry claims between systems. A signed JWT has three dot-separated sections: a header, a payload, and a signature. The header and payload are encoded as Base64URL text, which means they are easy to decode and inspect.
How JWTs work
JWTs usually carry claims such as the subject, issuer, audience, issued-at time, expiration time, and token identifier. A receiving system can verify the signature and validate those claims before trusting the token. This browser tool can generate synthetic HS256 tokens and decode token contents, but it does not act as an authentication service.
JWT header, payload, and signature
The header describes the token type and signing algorithm. The payload contains claims. The signature is created from the encoded header and payload plus a secret or key. For HS256, the signature uses HMAC with SHA-256 and a shared secret.
HS256 explained
HS256 means HMAC-SHA-256. It uses the same secret to sign and verify a token, so that secret must be kept private. For production systems, signing should happen on trusted server-side infrastructure with managed secrets, rotation, and access controls.
JWT decoding vs verification
Decoding a JWT only reads the Base64URL-encoded header and payload. It does not prove the token came from a trusted issuer and does not prove the signature is valid. A decoded JWT may be forged, expired, or intended for a different audience.
Common JWT claims
JWT expiration
The exp claim is a Unix timestamp that tells a verifier when a token should no longer be accepted. This tool can display whether a decoded exp value appears to be in the past, but that timing display is based only on decoded data and is not a trust decision.
Are JWTs encrypted?
Signed JWTs are not confidential. Anyone with the token can decode the header and payload. Do not place secrets, passwords, private keys, or sensitive personal information in a JWT payload unless your architecture uses proper encryption and access controls.
Safe JWT handling
Use this tool for development, testing, demos, and sample data. Do not paste production signing secrets into untrusted tools. Production authentication should use established server-side JWT libraries, strict algorithm allowlists, short expirations, issuer and audience validation, and secure secret management.
Privacy
JWT generation and decoding happen entirely in your browser. The tool does not upload your token, payload, signing secret, or decoded data, and it does not save those values in local storage, session storage, cookies, analytics events, or URL parameters.