Online JWT Generator
Generate, decode, and verify JSON Web Tokens (JWT) in your browser. Supports HS256/HS384/HS512, Base64URL, and common claims (iat/nbf/exp). No network calls.
Generate
Decode / Verify
How to use
Use this tool to build or inspect tokens.
- To generate: choose an algorithm, enter a secret, and edit the header/payload JSON (optionally auto-add iat/nbf/exp), then click Generate JWT.
- To decode/verify: paste a token into the JWT input box and click Decode or Verify.
- Use Copy Output to copy the token or decoded result.
FAQ
Does this JWT tool send my secret or token to a server?
No. Signing/decoding/verification runs locally in your browser and the script does not make network calls.
Which algorithms are supported?
HS256, HS384, HS512, and alg=none (unsigned). RSA/ECDSA are not included in this lightweight version.
Why does verification fail even though the token looks correct?
Most failures are due to a wrong secret, a changed token character, or a different alg than expected in the header.
What are iat, nbf, and exp?
They are standard timestamp claims (seconds since epoch): issued-at, not-before, and expiration.
Can I generate a token without a signature?
Yes—select alg=none. The signature part will be empty and verification is only a format check for alg=none.
Why does my payload JSON change order in the token?
JWT signing uses the exact JSON string; JSON key order may be normalized by the serializer, which changes the token value even if the data is equivalent.
Is this safe for production security decisions?
Use it for development/debugging. Production systems should verify tokens server-side with proper key management and constant-time comparisons.
Continue your workflow
Browse related tools by task. Use the improved core tools for a consistent workspace with file import, downloads and clear validation errors.