JWT Encoder and Verifier
Create a signed JSON Web Token from a JSON payload and a secret with HS256, HS384 or HS512, and verify an existing token's signature.
Free · No sign-up · Your inputs stay in your browser
Input
Create and verify an HMAC-signed JWT
Output
Could not sign
RFC 7519 with an HMAC signature (RFC 7518 section 3.2). The payload is readable by anyone; only the signature needs the secret. For tokens other services verify, prefer RS256 or ES256 so they hold only a public key.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Signed, not encrypted
Anyone can read a JWT's payload, as the JWT decoder on this site shows. The signature only proves who issued it and that it was not changed. Put identifiers and permissions in it, never secrets.
HMAC keys
RFC 7518 requires an HMAC key at least as long as the hash: 32 bytes for HS256. A short, guessable secret can be brute-forced offline from any one token. Generate it randomly, as the secret generator on this site does.
Verifying properly
A valid signature is the first check, not the only one. The server must also reject expired tokens (exp), check the issuer and audience, and pin the algorithm it expects rather than trusting the token's own alg header, which is how the 'alg: none' attacks worked.