Generador JWT
Create JSON Web Tokens with custom header & payload. Signed with HMAC-SHA256 in your browser · nothing leaves your device.
Generated Token
How It Works
- Decode a JWT: Paste any JWT token to instantly decode its header, payload, and signature — no secret needed to read the claims.
- Generate a JWT: Enter your payload as JSON, choose an algorithm (HS256, HS384, HS512), provide a secret, and generate a signed token.
- Verify a token: Paste a JWT and enter the signing secret to verify the signature and check expiration.
Why Use JWT Generator & Decoder?
JSON Web Tokens (JWTs) are the backbone of modern authentication — used in OAuth 2.0, OpenID Connect, API keys, and session tokens. Debugging JWT issues (expired tokens, wrong claims, bad signatures) normally requires writing code or using online tools that may log your tokens. This browser-based tool decodes and verifies JWTs locally, so your tokens and secrets never leave your device.
Features
- Instant decoding: Paste any JWT to see the decoded header and payload without providing the secret.
- Signature verification: Optionally provide the HMAC secret to verify the signature is valid.
- JWT generation: Create signed JWTs with custom payloads using HS256, HS384, or HS512.
- Expiry check: Automatically detects and highlights if the token is expired (exp claim).
- 100% local: All cryptography runs in your browser — tokens and secrets are never transmitted.
Frequently Asked Questions
Can I decode a JWT without the secret?
Yes. The header and payload sections of a JWT are only Base64url-encoded, not encrypted. You can read all claims without the secret. The secret is only needed to verify that the signature is valid (i.e., that the token was not tampered with).
Is it safe to paste production JWTs here?
Yes. This tool runs entirely in your browser — no data is sent to any server. Your tokens and secrets are processed only in your local JavaScript environment and are never logged or transmitted.
What is the difference between HS256, RS256, and ES256?
HS256 uses a shared HMAC secret (symmetric). RS256 and ES256 use public/private key pairs (asymmetric) — the private key signs the token, and the public key verifies it. This tool supports HMAC algorithms; for RS256/ES256 verification use a server-side library.