# JWT Decoder & Generator > Decode, verify, and generate JWT tokens online. Inspect payload claims with human-readable timestamps, detect expiry, verify HS256/HS384/HS512 signatures, and create signed tokens — all locally in your browser. The JWT Decoder & Generator lets you inspect, verify, and sign JSON Web Tokens without ever sending them to a server. Decode a token to read its header and claims, verify an HMAC-SHA256 signature against your secret, or mint a new signed token — all locally, so secrets never leave your browser. - **Live tool:** https://www.toolnova.org/dev-tools/jwt-forge - **Category:** Developer Tools (https://www.toolnova.org/dev-tools) - **Price:** Free - **Requirements:** Runs in a modern web browser · No signup · No install ## What this tool does - Decode header, payload & a full claims table - HS256, HS384 & HS512 signing and verification - Live signature verification with your secret - Expiry detection + human-readable iat/exp/nbf - Generate signed tokens live as you type - One-click expiry injection (1h, 24h, 7d) - Zero-server — keys never leave your browser ## How to use JWT Decoder & Generator 1. **Paste a token to decode** — Drop in a JWT and instantly see the decoded header and payload claims. 2. **Verify the signature** — Enter the shared secret to confirm the HMAC-SHA256 signature is valid and untampered. 3. **Switch to generate mode** — Build a payload, add an expiry claim (1h, 24h, 7d), and sign it with your secret. 4. **Copy the token** — Grab the Base64URL-encoded JWT for use in your app or API tests. ## Common use cases - A backend developer debugs why an auth token is being rejected. - An API tester mints short-lived tokens to exercise protected endpoints. - A security reviewer inspects the claims inside a suspicious token. - A student learns how JWT header, payload, and signature fit together. ## About ### What lives inside a JWT A JSON Web Token has three Base64URL parts: a header naming the algorithm, a payload of claims (who the token is for, when it expires), and a signature. Anyone can read the first two — they're encoded, not encrypted — which is why you should never put secrets in the payload. ### Decode vs verify Decoding just reveals the claims; it says nothing about whether the token is genuine. Verification recomputes the signature with your secret and checks it matches, proving the token hasn't been altered. This tool does both, side by side. ### Why local signing matters Your signing secret is the key to forging valid tokens, so pasting it into a server-side tool is risky. Here, generation and verification run entirely in your browser — the secret is used in memory and never transmitted. ## FAQ ### How do I decode a JWT token online? Paste your JWT token into the decoder. The tool automatically splits it into header, payload, and signature, displaying each section as formatted JSON. No secret key is needed just to decode the payload. ### Can I verify a JWT signature without sending it to a server? Yes. Enter your HMAC secret key and the tool verifies the signature locally using the CryptoJS library running in your browser. Your token and secret never leave your device. ### What information is stored in a JWT payload? Common JWT claims include: sub (user ID), exp (expiration timestamp), iat (issued at), iss (issuer), aud (audience), and custom application claims like roles or permissions. ### How do I check if a JWT token is expired? Decode the token and look at the exp claim — it's a Unix timestamp. The tool automatically checks this against the current time and tells you if the token is expired, valid, or about to expire. ### Is it safe to paste my JWT token into an online tool? Generally yes, with this tool — because it runs locally in your browser. Never paste JWTs containing sensitive data into online tools that send data to their servers. This tool is safe because nothing is transmitted. ### What algorithm does this JWT generator use? This tool uses HMAC SHA256 (HS256), the most common JWT signing algorithm. It uses a shared secret key for both signing and verification. For RS256 (asymmetric), a different tool with RSA key support is needed. ### Is it safe to paste my token here? Yes. Decoding, verification, and signing all happen locally in your browser — neither the token nor your secret is sent anywhere. ### How do I check if a token is expired? Decode it and read the exp claim; the tool shows the expiry timestamp so you can compare it to the current time. --- ToolNova — free, privacy-first browser tools. Most tools process data locally on your device. See https://www.toolnova.org/llms.txt for the full directory.