TokenSmith
Decode and generate JWTs, with HMAC signature verification.
JWT Token
Header
Payload
Data
Generated token
How a JWT works
A JSON Web Token has three parts separated by dots: header.payload.signature, each encoded in Base64URL. The header describes the algorithm, the payload carries the data (claims), and the signature guarantees nobody altered the content without knowing the secret:
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.4kP... └── header ──────────┘└── payload ───────┘└ sig ┘
This tool decodes with the browser's native atob and JSON.parse, and signs/verifies with native crypto.subtle (HMAC-SHA) — no external libraries, no server calls.
Frequently asked questions
Which signing algorithms can it verify?
HS256, HS384 and HS512 (HMAC with a shared secret). For asymmetric algorithms like RS256 or ES256 the content is decoded, but the signature can't be verified without the matching public key.
Is my secret or token sent to any server?
No. Verification and generation use the browser's native SubtleCrypto API; the secret never leaves your machine.
What are 'exp', 'iat' and 'nbf' in the payload?
Standard claims in Unix seconds: 'iat' is when the token was issued, 'exp' when it expires, 'nbf' from when it's valid. This tool also shows them as a readable date.
Can I generate a signed JWT from scratch?
Yes, on the Generate tab: pick the HMAC algorithm, write the payload as JSON and a secret, and the tool builds and signs the full token.