flashman
← All tools

Jwt

jwt • decode • generate • sign

Decode locally for inspection. Verification still belongs in your app or API.

Header
Payload
JWT generator
Create test tokens locally with HS256 secrets or RS256 private keys.
Use fake development secrets only; do not paste production signing material.
About this tool
Decode JSON Web Token headers and payloads, generate HS256 or RS256 test tokens, and export browser-generated RSA keys without sending data to a server.
Your input is processed in the browser. We do not upload tool payloads to our servers.
Common use cases
  • Read claims such as exp, sub, and aud during OAuth debugging.
  • Generate signed development JWTs from a shared secret or private key.
  • Autogenerate downloadable public/private key pairs for RS256 test environments.
  • Compare token payloads between environments.
Examples
Three-part structure
A JWT has header.payload.signature separated by dots. Decode existing tokens or create signed test tokens locally.
FAQ
Does this verify signatures?
No. Decoding is not verification, and generated tokens are for test workflows. Never trust a token based on decoding alone.
Which signing algorithms are supported?
The generator supports HS256 with a shared secret and RS256 with a PKCS#8 private key. RSA public/private key pairs can be generated and downloaded in the browser.
Is it safe to paste production tokens?
Tokens and signing keys may contain sensitive data. Prefer test values; processing stays local in your browser.
Related tools
encodepem key newlinepem · keyformatjsonjson · formatencodebase64base64 · encodedebughashsha256 · sha512
Related guide
Learn JSON Web Token structure, common claims, and why decoding is not the same as verification.
Read: JWT explained: how to decode tokens safely →