JWT HS256 Generator

Generate a compact HS256 JWS/JWT with Web Crypto using a secret that never leaves the browser.

Header JSON

Payload JSON

Shared secret

ReadyThe header alg is forced to HS256. Do not paste production secrets on devices you do not trust.

JWT contents are untrusted until signature verification and application-specific claim validation succeed. These browser-local tools do not contact an issuer, fetch keys, or validate authorization policy.

JWT inspector, claim check & HS256 verification

Keep the generator above for creating a token. Use this panel to inspect any compact JWT, check common time claims, and verify an HS256 signature against the secret you actually trust.

Expiry minutes

JWT tokenVerification secret

—alg

Not checkedSignature

—Expiration

—Activation

—Secret length

Decoded headerDecoded payload

Standard claim status

Ready.

JWT trust boundaries

Decoding is not verification

JWT header and payload segments are Base64URL-encoded and readable without a secret. Treat decoded claims as untrusted until the HS256 signature matches a trusted secret and the application checks issuer, audience, expiry, and other policy requirements.

Use an adequately long random secret

HS256 security depends on the shared secret. A memorable password is not equivalent to a uniformly random 256-bit key. The verifier below reports entered secret length, but key generation and secret storage still belong in a secure application environment.

Time claims need the right clock and policy

exp, nbf, and iat use NumericDate seconds. Production systems often allow a small clock-skew window and may require issuer/audience checks in addition to time validity. The browser panel shows the raw claim status but does not implement your application’s authorization policy.