Web

JWT Lab

A local JWT workbench for development and debugging. Create HS256 tokens from JSON header and payload, or verify an existing token against a shared secret without sending it anywhere.

JWT Lab intentionally supports HS256 only. Tokens declaring none, RS256, ES256 or any other algorithm are decoded for inspection but rejected during verification to avoid false confidence.
header.json
payload.json
token.jwt
runtime

Browser-local execution

Inputs stay inside the current tab unless you copy, download or explicitly export.

memory

Session handoff

Magic Paste can pass input to a target tool through sessionStorage, never through the URL.

control

User-owned state

Favorites, recent tools and workflow history are local browser data you can clear from the browser.

smart handoff graph

Suggested next moves

session handoff ready
/web
JWT Decoder
Decode and inspect JWT tokens — header, payload, claims.
/crypto
Secret Scanner
Detect leaked tokens, private keys, JWTs and high-entropy strings before you share text.
/time
Unix Timestamp Converter
Convert between Unix timestamps and human-readable dates.
/encoding
Base64 Encoder / Decoder
Encode text or files to Base64 and decode back, instantly.
sponsor

Fixed native slots for developer products. No third-party tracking, no popups, no layout shift.

Sponsor this tool
01

How to use

  1. 01Choose Sign HS256 to create a token from JSON header and payload.
  2. 02Choose Verify HS256 to paste a token and secret.
  3. 03Copy the signed token or verification result.
02

FAQ

Should I paste production secrets here?
The computation is local, but production secrets should still follow your team's handling policy. Use test secrets whenever possible.
Which algorithms are supported?
This lab focuses on HS256 because it is common for local development and can be implemented with browser Web Crypto.
03

Related tools