JWT Builder (HS256)

When debugging an API you almost always need a JWT with specific claims: a different sub, an already-expired exp, one extra field in the payload. Spinning up the backend just to mint a test token is slow. Here you edit the header and payload as JSON, type the secret, and the HS256 token appears assembled and signed in real time, with the three parts color-coded so you can see where one ends and the next begins.

The three parts are base64url, not plain base64: '+' becomes '-', '/' becomes '_' and the '=' padding is dropped, which is why pasting a JWT into a generic base64 decoder often fails. The signature is an HMAC-SHA256 computed over the exact bytes of header.payload. One deliberate gotcha: changing the alg field in the header changes nothing here, the tool always signs with HS256. The same lesson applies to servers: blindly trusting the alg inside a token is a classic vulnerability.

Use a test secret, never a production one, even though the signature is computed by SubtleCrypto right in your browser with nothing sent anywhere. Remember a JWT is signed, not encrypted: anyone can decode the payload without the secret, so keep passwords and sensitive data out of the claims. And the most common bug of all: exp and iat are Unix seconds, not milliseconds; pasting Date.now() without dividing by 1000 produces a token that only expires thousands of years from now.