Fastsoft
中文

Developer Tools

JWT Generator & Decoder

Generate, decode and verify HMAC-signed JWTs in your browser.

JWT Generator & Decoder
Create HS256 / HS384 / HS512 JWTs in your browser, or decode and optionally verify a signature.

Base64URL / Hex are read as raw bytes, so you can paste output from the JWT Secret Generator.

HS256 / HS384 / HS512 require at least 32 / 48 / 64 secret bytes respectively.

Decoding only displays content. Verify with the correct secret to check integrity. Signature verification does not check claims such as exp or nbf.

Fastsoft / Guide

Practical guide

Use browser Web Crypto to create HMAC-signed JWTs, or decode a three-part token into its header, payload and signature segment. Enter a secret to verify HS256, HS384 or HS512 signatures.

How to use it

  1. To generate, enter a JSON object as the payload, choose an algorithm and secret format, then enter a secret.
  2. Generate and copy the JWT. Switch to Decode JWT to inspect the generated token.
  3. To inspect another token, paste it in full. For verification, enter the same secret and format used by its issuer.

Example

Enter {"sub":"123","name":"Fastsoft"}, choose HS256 and a random test secret of at least 32 bytes. Decode the resulting token with the same secret to see a valid signature.

What to know

Generation and verification support HS256, HS384 and HS512 only; generation requires keys of at least 32, 48 and 64 bytes respectively. Tokens using other algorithms can be decoded but are not verified. Decoding does not establish trust; signature verification does not check claims such as exp, nbf, iss or aud. The secret stays in page memory. Production tokens should be issued by a trusted server.

Common question

Why can I read a payload when the signature is not verified?

The first two JWT segments are only Base64URL encoded and can be read directly. Verify with the correct secret before trusting their integrity.

Related tools