JWT Generator and Checker

How to use it

1. Write the Header (JSON) and the Payload (JSON). Use Set iat to now, Set nbf to now or Set exp in to fill the times.
2. Choose the Algorithm and type the Secret. Choose Base64 under Secret encoding if the secret is written in Base64.
3. Copy the Token. It has three parts separated by dots: the header, the payload and the signature.
4. Paste a token into Token to check to see whether its signature matches the secret above.

How a JWT is signed

A JSON Web Token (RFC 7519) is a header and a payload, each written as JSON and encoded in Base64url (RFC 7515), joined by a dot. The signature is an HMAC of those two parts, made with the secret (RFC 7518, section 3.2). The header names the algorithm in its alg field, and this page sets that field to the algorithm you choose.

The page writes each JSON object in its compact form before encoding it, so the signed bytes are the compact form of what you typed, not the text with its spaces and line breaks. Any party that checks the token works from the bytes it receives, so the token is valid either way.

signing input = BASE64URL(header) . BASE64URL(payload)
signature    = HMAC-SHA-256(secret, signing input)
               (HS384 and HS512 use HMAC-SHA-384 and HMAC-SHA-512)
token        = signing input . BASE64URL(signature)

The times in the payload

The claims iat (issued at), nbf (not before) and exp (expiration time) are NumericDates: seconds since 1 January 1970 at 00:00 UTC (RFC 7519, sections 2 and 4.1). A token is not accepted at or after exp, and not before nbf. The buttons write the time from your device's clock, so a wrong clock gives a wrong time.

What checking does and does not do

Checking recomputes the HMAC of the header and payload exactly as they were pasted, and compares it with the signature. It refuses alg none and every algorithm except HS256, HS384 and HS512, so a token cannot choose a weaker check.

It does not check what the claims mean: that iss is the issuer you expect, or that aud names your service. Your application must check those, as RFC 8725 recommends.

Frequently asked questions