HMAC with SHA-256. Shared symmetric key. Recommended for general use.
How it works
A JSON Web Token (JWT) is a compact, signed token that carries information (claims) between two parties. It has three parts separated by dots —header, payload, and signature—, each Base64URL-encoded.
In Generate mode you define the header and payload in JSON and sign with a secret key (HMAC) or a private key (RSA/ECDSA). In Read mode you paste an existing token to inspect its content and verify the signature.
The payload is not encrypted: anyone can read it by decoding the Base64URL. The signature only guarantees that the token was not altered, it does not hide it. Never put sensitive data in a JWT.
Examples
header{"alg":"HS256","typ":"JWT"} → eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9payload{"sub":"1234567890","name":"John Doe","iat":1516239022} → eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQtokeneyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cThe signature (third part) depends on the algorithm and the key; this example uses HS256 with the key "your-256-bit-secret".Use cases
- Authenticate users in APIs: the server issues a signed token and validates it on each request without storing a session.
- Inspect and debug authentication tokens to see their claims (sub, exp, roles) and dates.
- Verify a token's signature with the secret key or the public key to confirm it was not tampered with.
- Generate test tokens with different algorithms (HMAC, RSA, ECDSA) when developing an authentication flow.
Frequently asked questions
Is the content of a JWT encrypted?
No. The header and payload are only Base64URL-encoded, which anyone can decode. The signature guarantees integrity (that it was not altered), not confidentiality.
What is the difference between HS256 and RS256?
HS256 uses a single shared secret key to sign and verify (HMAC). RS256 is asymmetric: it signs with a private key and verifies with the public one, ideal when many services need to validate without being able to issue.
What do the iat, exp, and nbf claims mean?
They are standard timestamps: iat (issued at), exp (expires at), and nbf (not valid before). They are expressed in seconds since 1970 (Unix epoch).
Why is the "none" algorithm discouraged?
Because it produces an unsigned token: anyone can modify the payload and it will still be accepted. It is only useful for testing, never in production.
Is my token sent to a server?
No. Generation, decoding, and verification happen entirely in your browser; the token and keys never leave your device.