DDEVKIT/TOOLS
中

JWT Generator & Verifier

Generate JWTs and verify HMAC signatures

Runs in your browserUtility03 — Encoding & Crypto

What is JWT Generator & Verifier?

This JWT generator signs a custom payload with HS256, HS384, or HS512 and returns the complete token; it can also take any token, verify its signature against the same secret, and check whether it has expired. Both signing and verification happen locally in the browser.

How to use JWT Generator & Verifier

  1. 1Edit the JSON payload, adding claims such as sub, exp, and iss as needed.
  2. 2Enter the HMAC secret and choose an algorithm.
  3. 3Click "Generate token" — the result is ready to drop into a test request.
  4. 4Paste any token into the verification box and click verify to check its signature and validity window.

How do I do this in code?

Use the tool above for one-off work; for anything you repeat, move it into a script or your project.

import jwt from 'jsonwebtoken';

const token = jwt.sign({ sub: '10241', roles: ['admin'] }, process.env.JWT_SECRET, {
  algorithm: 'HS256',
  expiresIn: '1h',
});

const claims = jwt.verify(token, process.env.JWT_SECRET);

Frequently asked questions

Why are only HMAC algorithms supported?+

Asymmetric algorithms such as RS256 would require pasting a private key into the page, and private keys do not belong in a browser. HMAC is enough for testing; when you need RS256, sign on the backend and use the front end only to decode and inspect.

Can I use a token generated here in production?+

Not advisable. Production tokens should be issued by your authentication service with correct iss, aud, and exp claims and a refresh mechanism behind them. Tokens from this tool are best used for local integration work, writing test cases, and confirming that your server-side validation is actually strict.

The signature verifies here but my API still returns 401 — why?+

A valid signature only proves the token was not modified. Your server also checks that iss and aud match, that exp and nbf place the token inside its validity window, that the algorithm is on its allow list, and that the token has not been revoked. Walk through your server validation logic in that order to find the mismatch.

Related tools

All tools

Base64 Encoder & Decoder

Encode and decode Base64, with UTF-8 and URL-safe support

File to Base64

Convert files to Base64 and data URIs — nothing is uploaded

URL Encoder & Decoder

Percent-encode URLs, with separate modes for full URLs and parameter values

HTML Entity Encoder

Escape and unescape HTML entities

Hex to Text Converter

Convert between text and hex with several separator styles

Unicode Escape Converter

Escape and unescape Unicode in three notations