Generate local HMAC test tokens, strictly validate JWT claims, and verify signatures with HMAC, PEM, JWK, or JWKS keys
For local development and testing; the generated token is loaded above and can be verified immediately.
HS256 requires at least 32 UTF-8 bytes.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}| Claim | Unix | ISO 8601 | Status |
|---|---|---|---|
| iat | 1516239022 | 2018-01-18T01:30:22.000Z | Issued-at time is valid |
Leave issuer or audience blank to skip matching; time claims are always checked.
Claims satisfy the current rules
Algorithm: HS256. Supports HS, RS, PS and ES 256/384/512 families; JWKS keys are selected by kid.
Decoding does not establish trust. Accept a JWT only after its signature verifies and exp, nbf, iss, aud and other claims satisfy your application rules. Everything is processed locally.
Generate local HMAC test tokens, strictly validate JWT claims, and verify signatures with HMAC, PEM, JWK, or JWKS keys. It requires no desktop installation and supports common developer workflows directly in a modern browser.
Core processing runs locally in your browser. Tool input is not uploaded; downloads and clipboard actions are handled by the browser.
Continue with the next step in the same workflow.
Calculate chunked local MD5 checksums for text or files, verify GNU/BSD manifests, and export compatible checksum files
Calculate SHA-1 hashes for text, files, or HMAC workflows
Calculate SHA-256/384/512 hashes for text, files, or HMAC workflows
Encrypt text locally with AES-256-GCM, random salt and IV, authenticated metadata, and legacy-payload compatibility