JWT Generator & Validator

What it does

Create HS256 JWTs, decode a token's readable header and payload, or compare its HMAC signature with a secret you provide. A decoded token is not trustworthy until its signature and claims are validated by the application that uses it.

How to use it

1. Choose Generate, Decode, or Verify and provide the token details for that mode.
2. For Verify, enter the HS256 signing secret and run the signature check.
3. Review the result; never paste production secrets or tokens into an untrusted environment.

Useful for

• Learning how JWT header, payload, and signature parts fit together.
• Testing a development HS256 token or inspecting non-sensitive sample claims.