 JWT Utility

The JWT Utility provides two workflows in a tabbed interface: Generate signed tokens from scratch, and Decode existing tokens to inspect or validate them.

:::info Screenshot needed — light/dark 📸 jwt-utility-generate-light.png and jwt-utility-generate-dark.png — Generate tab with algorithm pills, claims grid, and generated token output jwt-utility-decode-light.png and jwt-utility-decode-dark.png — Decode tab with decoded header/payload and signature validation :::

Generate Tab

Use this tab to create a signed JWT with custom claims.

Algorithm

The signing algorithm is chosen with two pill groups:

Pill group	Options
Family:	HMAC (HS), RSA (RS), ECDSA (ES), PS (PS)
Size:	256, 384, 512

The combined selection is shown as a tag (for example HS256, RS384, ES512, PS256). HMAC families use a symmetric secret; RSA / ECDSA / PS families use an asymmetric key or certificate.

Signing Key

The Signing Key field uses a key editor with a Key Provider: pill bar:

Key provider	Description
PFX/P12 File	Import a PKCS#12 certificate (.pfx / .p12) with an optional password
PEM Text	Paste a PEM private key
JWK	Paste a JSON Web Key
Store	Select a certificate from the Windows / OS X.509 store, or paste a thumbprint
Profile	Use a saved credential profile by name
Symmetric	Enter a shared secret (format: Text / Base64 / Hex) with a show/hide toggle

A Test button verifies that the configured key loads. An error info bar appears if the key is missing or invalid for the selected algorithm.

Claims Editor

Claims are edited in a data grid with four columns:

Column	Description
Name	Auto-complete textbox with well-known claim names (type to filter)
Type	Data type: String, Numeric, Decimal, Boolean, Timestamp, and others
Value	The claim value (string representation)
Description	Read-only description of the well-known claim (if applicable)

Toolbar buttons:

•  Add Claim — Flyout menu to add claims:
  • Custom… — a blank claim row
  • Standard Claims — iss, sub, aud, exp, nbf, iat, jti
  • Identity Claims — name, email, email_verified, given_name, family_name, middle_name, nickname, preferred_username
  • Profile Claims — profile, picture, website, gender, birthdate, zoneinfo, locale, updated_at
  • Contact Claims — phone_number, phone_number_verified, address
  • Authorization Claims — azp, roles, groups, scope, client_id
• Right-click a claim row and choose Delete Claim () to remove it.
• Timestamp claims show an edit button to open a date/time picker.

Generating the Token

Click Generate to produce the JWT. The encoded token appears in the read-only Token field below the button. Copy it for use in Authorization headers or test automation steps.

Decode Tab

Use this tab to inspect an existing JWT. A sample token is preloaded when the tab opens.

Inspection

1. Paste the token in the Token to Decode text area
2. The Header and Payload are automatically decoded and displayed as formatted JSON in the side-by-side editors
3. An expiration info bar shows whether the token is still valid or has expired (it reads the exp claim and reports "Token expires in …" or "Token expired … ago")

If the token cannot be parsed, an error info bar shows "Invalid JWT: …".

Signature Validation

To validate the token's signature:

1. In the Signature section, provide the Verification Key / Secret using the same key editor as the Generate tab (symmetric secret, PEM, JWK, certificate, or store)
2. Click Validate Signature ()
3. A Validation Result info bar confirms "Validation OK. Signature is validated." (green) or reports a mismatch / error (red)

See Also

• Base64 Encoder — for Base64Url encoding used in JWT parts
• Regular Expression Tester