stboxsandbox tools
All tools

JWT Workbench

Decode, mint, and verify JWTs — HMAC/RSA/ECDSA locally, or auto-fetch issuer JWKS via OIDC discovery.

Identity & Auth
Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.WIhTJ3KWJAVfMaFBJMXBQJeBTx8hOdtqgdO03Edi3dk

■ Header■ Payload■ Signature
ActiveHS256

Header

{
  "typ": "JWT",
  "alg": "HS256"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1916239022
}
sub
1234567890
name
John Doe
iat
1516239022 (2018-01-18T01:30:22.000Z)
exp
1916239022 (2030-09-21T16:37:02.000Z)

Verification

Detected alg HS256

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It usually has three Base64URL segments — header, payload, and signature — separated by dots. Developers use JWTs for OAuth access tokens, OIDC ID tokens, session cookies, and API authentication.

This workbench lets you decode claims instantly, mint new tokens with HMAC or asymmetric keys, and verify signatures locally. For production issuers, you can resolve JWKS via OIDC discovery so you can validate tokens against the issuer's published public keys without pasting PEMs by hand.

How to use this tool

  1. Paste an encoded JWT into the Decode tab (or start from the sample token).
  2. Inspect header and payload claims, then verify with a shared secret, PEM/JWK, or issuer JWKS URL.
  3. Switch to Generate to craft a header/payload, pick an algorithm (HS256, RS256, ES256), sign, and optionally send the token back to Decode.

Frequently asked questions

Is my JWT sent to a server?

Decoding and local verify/sign stay in your browser using WebCrypto and jose. Only optional OIDC/JWKS discovery may fetch public metadata through a CORS-safe proxy — your private keys and full tokens are not stored.

Which algorithms are supported?

HS256 (HMAC), RS256 (RSA), and ES256 (ECDSA) for signing and verification, plus JWKS-backed verify for issuer-published keys.

Can I validate an OIDC ID token?

Yes. Point the verifier at the issuer's discovery or JWKS URL, then check signature and standard claims locally in the workbench.