JWT Generator & Verifier
Sign JWTs with HMAC-SHA256 and verify their signatures
Enter JSON for the header and payload and this tool immediately signs a JWT with an HMAC-SHA256 secret. Paste in an existing token and it verifies the signature with your secret, showing whether the token has been tampered with along with the decoded contents. It's handy for backend developers testing API auth tokens and for frontend developers inspecting a token they've received. All signing and verification runs inside your browser, so your secret and tokens are never sent to a server.
도구를 불러오는 중…
🔒 Everything runs 100% in your browser. Your files and input are never uploaded to any server.
How to use
- On the Sign tab, enter your header and payload JSON.
- Enter an HMAC-SHA256 signing secret and the JWT is generated automatically.
- Switch to the Verify tab and paste in the JWT you want to check.
- Enter the secret and the signature status plus the decoded header and payload appear right away.
FAQ
- Which algorithm does this tool use to sign JWTs?
- Only HMAC-SHA256 (HS256) symmetric-key signing is supported. Asymmetric algorithms such as RSA are not available.
- Are my secret and token sent to a server?
- No. All signing and verification is done locally using your browser's Web Crypto API, and nothing is transmitted anywhere.
- Why does verification come back as failed?
- Either the secret you entered doesn't match the one used to issue the token, or the token's contents were modified after it was issued.