🔑 JWT Playground

Decode a JSON Web Token, edit the payload and re-sign it with real HMAC-SHA256 (Web Crypto — not faked), then watch a Spring Security resource server validate it: signature → expiry → scopes. Tamper with it or let it expire and watch it get rejected. 100% in your browser.

★ Star on GitHub

Encoded token

■ header ■ payload ■ signature alg: HS256

Decoded

Header

      
Payload — edit me

      
      
Verify signature (HMAC-SHA256 secret)

      

        
        
      

      

    

  


  
  

    
What the claims mean

    

      
ClaimValueMeaning

      
    

  


  
  

    
How a resource server validates it