JWT Tools

These tools work with JWTs. Decode a token to read its contents, check whether it has expired, verify a signature with your key, build a signed test token, or generate a signing secret of the right size.

How to choose: to see what a token contains, decode it; the header and payload are only encoded, not encrypted, so anyone holding the token can read them. To find out why a login failed, check the expiry time next, then verify the signature with the key that signed it. To test your own code, build a signed test token and use a secret of a suitable length for HS256. Everything runs in your browser, so a token you paste is not uploaded. Still, avoid pasting live production tokens into any tool and use test tokens when you can.

Tools in this group

• Decode Token — Paste a token or an Authorization header to see what is inside it.
• JWT Expired? Expiration Checker — Paste a token to see whether it has expired and exactly when.
• JWT Generator — Write a header and payload, add a secret and get a signed test token.
• JWT Secret Generator — Generate random signing secrets of the right size for HS256, HS384 or HS512.
• JWT Validator — Verify a token's signature with your key and check its expiry, issuer and audience.