DeveloTools

TokenSmith

Decode and generate JWTs, with HMAC signature verification.

100% client-side

JWT Token

Paste a token to decode it.

Header


          
Payload

          

          

        

      

    


    
    

      

        

          
Data

          

            
            
          

          

            
            
          

          

            
            
          

          

            
            
          

        


        

          

            
Generated token

            

              
            

          

          
—

          
—

        

      

    


    

      
What is a JWT?

      
A JWT (JSON Web Token, RFC 7519) is a compact, signed piece of text that web apps use to prove who a user is without checking a database on every request — it's what's usually stored after you log in to keep you authenticated. It's not encrypted, just signed: anyone can read what's inside, but only someone with the secret key can have created a valid signature. TokenSmith lets you inspect one, or build your own for testing.


      
How to use TokenSmith

      
    
        
  1. To inspect a token, stay on the Decode tab and paste it into the JWT Token box (or click Example to try a sample).
    2. 
        
  2. The Header and Payload panels show the decoded contents instantly.
    3. 
        
  3. Optionally enter the shared secret in the "Secret" field to verify the HMAC signature is valid.
    4. 
        
  4. To build a token instead, switch to the Generate tab, pick an algorithm, write your payload as JSON and a secret.
    5. 
        
  5. Click Copy to grab the generated token.
    6. 
      


      
How a JWT works

      
A JSON Web Token has three parts separated by dots: header.payload.signature, each Base64URL-encoded per the compact serialization defined in RFC 7515 (JWS). The header describes the algorithm (per RFC 7518, which defines HS256/HS384/HS512), the payload carries the data (claims), and the signature guarantees nobody altered the content without knowing the secret:

      
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.4kP...
└── header ──────────┘└── payload ───────┘└ sig ┘

      
This tool decodes with the browser's native atob and JSON.parse, and signs/verifies with native crypto.subtle (HMAC-SHA) — no external libraries, no server calls.


      
Frequently asked questions

      

        Which signing algorithms can it verify?
        
HS256, HS384 and HS512 (HMAC with a shared secret). For asymmetric algorithms like RS256 or ES256 the content is decoded, but the signature can't be verified without the matching public key.

      

      

        Is my secret or token sent to any server?
        
No. Verification and generation use the browser's native SubtleCrypto API; the secret never leaves your machine.

      

      

        What are 'exp', 'iat' and 'nbf' in the payload?
        
RFC 7519's registered claims, in Unix seconds: 'iat' is when the token was issued, 'exp' when it expires, 'nbf' from when it's valid. This tool also shows them as a readable date.

      

      

        Can I generate a signed JWT from scratch?
        
Yes, on the Generate tab: pick the HMAC algorithm, write the payload as JSON and a secret, and the tool builds and signs the full token.

      

    


    

      
Related tools