← All articles · Dev & Text · about 5 min read
JWTs explained: how to read, verify and create a token (HS256)
You've seen 'Authorization: Bearer eyJ...' in a request. That blob is a JWT — a JSON Web Token. The JWT tool decodes it, verifies its signature (HS256), and can create one. Here's what's actually inside.
The three parts
A JWT looks like aaa.bbb.ccc — three base64url segments separated by dots. Part 1 is the header (algorithm and token type). Part 2 is the payload (your claims: user id, expiry, scopes). Part 3 is the signature, proving the token hasn't been tampered with.
Decode vs verify
Anyone can decode a JWT — it's just base64, not encryption. 'Decode' shows you the claims. 'Verify' is the real check: it recomputes the signature using the secret and the HS256 algorithm, and tells you whether it matches. A token can decode fine but fail verification if it was altered or signed with a different secret.
Create your own
Switch to the Create tab, paste your secret, write the payload JSON, and the tool signs it with HS256. Use this to test an API locally or to learn how tokens are formed — never paste a real production secret into any web tool you don't control. (This one runs entirely in your browser.)
Common pitfalls
The 'exp' claim is in seconds since epoch, not milliseconds — a frequent bug. An expired token verifies structurally but is rejected by the server. And remember: decoding shows the payload but does NOT prove authenticity; only verification does.
Frequently asked questions
Is a JWT encrypted?
No. The payload is only base64-encoded, so anyone who sees the token can read it. Use HTTPS and never put secrets in the payload. Encryption is a different standard (JWE).
What does HS256 mean?
HS256 is HMAC with SHA-256 — a symmetric signature where the same secret signs and verifies the token. The tool recomputes the HMAC and compares it to the signature.
Why does my token say 'expired' after verification?
The 'exp' claim is a Unix timestamp in seconds. If it's in the past, the token is expired even if the signature is valid. Check you're using seconds, not milliseconds.
Is the JWT tool private?
Yes. Decoding, verifying and creating all run in your browser. Still, avoid pasting real production secrets into any site.