JWT 生成・デコード

生成 & デコード JWTs for Authentication Testing

JSON Web Tokens (JWTs) are the standard for API authentication and authorization. Whether you're building an auth system, testing token flows, or debugging authentication issues, you need a way to quickly 作成 and inspect JWTs without writing code.

This JWT Generator lets you 作成 tokens with custom headers and payloads, sign them with HMAC secrets, and instantly inspect any JWT by decoding it. Test your authentication before deploying, verify token structure without extra tools, and debug token-related issues faster.

生成 Custom JWTs

Define your token in three parts:

Header: Standard JWT header fields identifying the token type and hashing algorithm. Edit the JSON to customize if needed, though defaults work for most cases.

Payload: The actual token data—user ID, claims, roles, expiration time, etc. Define whatever claims your application expects. The tool accepts any valid JSON.

Secret Key: The HMAC secret used to sign the token. This is crucial: use the same secret when validating tokens in your application. The tool never sends this anywhere—it stays in your ブラウザ.

Click 生成, and you instantly get a valid, signed JWT ready to use in testing.

Three HMAC Algorithms Supported

HS256 (HMAC-SHA-256): The most common choice. Balances security and performance.

HS384 (HMAC-SHA-384): Stronger hashing for higher security requirements.

HS512 (HMAC-SHA-512): Maximum security with SHA-512 hashing.

Choose based on your application's security needs.

デコード Any JWT

Have a JWT from an API response or log? Paste it in the デコード section and instantly see the デコードd header and payload. This is invaluable for:

• Inspecting API Responses: Extract the JWT from an authentication response and see what claims it contains
• Debugging Auth Issues: Check if a token has the expected user ID, roles, expiration time, etc.
• Verifying Token Structure: Ensure your auth server is issuing tokens with the correct フォーマット
• Token Analysis: See at a glance what data a token carries

Note: Decoding doesn't verify the signature—it just extracts and displays the data. This is safe for inspection but doesn't prove the token is valid.

Color-Coded Token Display

When you 生成 a JWT, it's displayed with color coding showing the three segments:

• Header segment in one color
• Payload segment in another
• Signature segment in a third

This makes it easy to spot which part is which and understand the token structure.

Common Testing Scenarios

Auth Flow Testing: 生成 tokens with different payloads and test how your application handles them. 作成 tokens with various expiration times, roles, or user IDs without needing a full auth server.

Bearer Token Validation: 生成 a token, copy it, add it as a Bearer token to API requests, and verify your authorization middleware accepts it.

Token Claims Verification: Test that your application correctly extracts and uses claims from tokens by generating tokens with specific claim values and checking if your app processes them correctly.

Security Testing: 生成 tokens with expired timestamps or invalid signatures (by using different secrets) to test how your app handles invalid tokens.

100% ブラウザ-Based, Completely Secure

All JWT generation and decoding happens in your ブラウザ using the native Web Crypto API. Your secrets never leave your machine, and your 生成d tokens aren't sent anywhere. This is safe for testing with production secret values—they never touch an external server.

Copy & Use Immediately

生成d JWTs copy with one click. Paste directly into API request headers or tool test fields without additional フォーマットting.