Decode a JWT's header and payload and show its algorithm and exp time; the signature is not verified.
JWT Generator (HS256)
Runs locally
Use JWT Generator (HS256)
What it does
Sign a JSON payload with a shared secret and get a compact HS256 JSON Web Token. Use it to build test tokens, for example to check that your API rejects a token signed with the wrong secret or past its exp time.
It runs entirely in your browser: nothing you enter is uploaded.
Example
jwt.io sample payload
{"sub":"1234567890","name":"John Doe","iat":1516239022}eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.MRvO3fE0o9C-pZfd3pI0hMDDXihJfQa1XPQ-UAelzaIWith the default secret my-secret-key the token ends in MRvO3fE0o9C-pZfd3pI0hMDDXihJfQa1XPQ-UAelzaI; with the secret your-256-bit-secret it matches the well-known jwt.io sample token ending in SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c.
FAQ
How is the token built?
The header {"alg":"HS256","typ":"JWT"} and your payload, re-serialised as compact JSON, are Base64url-encoded and joined with a dot. The signature is HMAC-SHA-256 over that string with your secret, computed by the Web Crypto API.
What does it not do?
Only HS256 is available. The secret is used as UTF-8 text (a Base64-encoded key is not decoded first), and claims such as iat or exp are neither added nor checked, so set them in the payload yourself.
Is my secret sent anywhere?
No. Signing runs locally through crypto.subtle, and the secret and payload are not uploaded or stored. Use test secrets only, never the signing key of a production system.