What JWT Studio helps you do
Use one local workspace for the JWT tasks that usually get split across several utilities. Decode an existing token, inspect registered time claims, edit the header and payload, create an HMAC signature, and verify whether a token matches the secret you expect.
Check the tool page and Privacy Policy for how this workflow handles your input.
How to use JWT Studio
- Paste a compact JWT to decode its header and payload, then review its algorithm, registered claims, and time-based status.
- Enter the expected HMAC secret to verify an HS256, HS384, or HS512 signature, or edit the JSON to create a local test token.
- Sign the edited token, verify the result, and copy it into your API testing workflow.
What you can do with JWT Studio
- Decode Base64url header and payload data, including Unicode claims.
- Show whether exp, nbf, and iat values make a token active, expired, or not active yet.
- Edit JSON and create HS256, HS384, or HS512 tokens with the Web Crypto API.
- Verify HMAC signatures without uploading the token or secret.
- Copy the finished compact JWT for local testing.
Example: debug an API bearer token
Paste the bearer token and inspect its algorithm, issuer, audience, subject, and timing. An expired exp value or future nbf value can explain a rejected request even before signature verification.
For an HMAC token, enter the expected secret and verify the signature. If you need a local test token, edit the claims, select an HS algorithm, sign it, and copy the result into API Request Studio as a bearer token.
What to know before you start
- Decoded content is not proof of authenticity; always verify the signature before trusting claims.
- HMAC verification uses the same shared secret as signing. Treat that secret as sensitive.
- The status check uses your device clock and does not apply server-specific clock-skew allowances.
- JWT Studio decodes other algorithms but signs and verifies only HS256, HS384, and HS512.