JWT Debugger & Token Generator

Purpose

Use this tool to inspect a JSON Web Token's header and payload, check whether it has expired, verify its HMAC signature against a known secret, or generate a new signed token for testing — all without leaving your browser.

Main steps

1. 1Switch between "Decode & verify" and "Generate" using the mode toggle above.
2. 2To decode, paste any JWT into the Token box — the header and payload are decoded instantly, and iat/exp/nbf claims are shown with their status.
3. 3To verify an HMAC-signed token (HS256, HS384, or HS512), enter the same secret used to sign it in the Signature panel; a badge confirms whether the signature matches.
4. 4To generate a token, edit the claims JSON, choose an HMAC algorithm and a secret (or click Random to generate one) — the signed token updates instantly.
5. 5Everything runs in your browser using the Web Crypto API — no token or secret is ever sent to a server.
6. 6Note: signature verification for asymmetric algorithms (RS*, ES*, PS*) isn't supported in this tool — only the decoded header and payload are shown for those tokens.