JWT Claims Editor
Free JWT claims editor that decodes a token, lets you edit the payload, and re-signs it with HS256 in your browser.
Loading tool...
What is JWT Claims Editor?
The JWT Claims Editor decodes a token into editable header and payload JSON, lets you change any claim, and re-signs the result with HS256, HS384 or HS512 using Web Crypto — the same HMAC your backend uses. The original claims stay visible next to the re-signed token so every edit is reviewable, and a clear note marks the output as a testing artifact. There is no server: the token and secret live and die in your tab.
Key Benefits
- Editable JSON for header and payload with instant re-signing
- HMAC algorithms handled through standard Web Crypto
- Before-and-after claims side by side for reviewable edits
- Clear guardrails: asymmetric algorithms explained, not broken
- Secret and token never leave the browser tab
Common Use Cases
- •Fixing a typo in a test token without redeploying auth code
- •Trying role or scope values against local middleware
- •Checking how a claim change alters the signature bytes
- •Producing signed fixtures for integration tests
- •Teaching how JWT signing inputs are constructed
How to Edit and Re-Sign a JWT
- Paste and decode: Paste the token and click Decode token. The header and payload are unpacked into editable JSON boxes; a malformed token explains what is wrong instead of failing silently.
- Edit the claims: Change any claim in the payload JSON — roles, scopes, expiry — and adjust the header if needed. The original claims stay visible in the comparison panel.
- Choose the algorithm and secret: Pick HS256, HS384 or HS512 and enter the shared secret your backend would use. It stays in this tab and is never transmitted.
- Re-sign and compare: Click Re-sign token to produce the new signature with Web Crypto, then compare the before and after claims and copy the resulting token for your test.
Key Features
- Decode any three-section JWT into editable JSON
- Re-sign with HS256, HS384 or HS512 through Web Crypto
- Original claims displayed beside the re-signed result
- Algorithm override with explicit typ header handling
- Private by design — token and secret never leave the tab
Frequently Asked Questions
Is editing a JWT the same as forging it?
For HMAC tokens, re-signing with the real secret produces a valid token — which is exactly why this tool exists for testing, and why it keeps your secret in the tab. For asymmetric algorithms (RS256, ES256) the signature requires a private key, so the editor limits re-signing to the HS family and explains the limitation instead of producing a broken token.
Does my secret or token get sent anywhere?
No. Decoding happens with browser APIs and signing happens with Web Crypto inside the page. There is no server call in the tool, and clearing the tab discards both the token and the secret.
Why did my RS256 token not re-sign?
RS-family and ES-family signatures need the private key to compute, not just the shared secret. The editor flags those algorithms on decode and lets you inspect the claims, but it only signs HMAC tokens so the output is always verifiable rather than broken.
What is the typ header for?
The typ header declares the media type of the token, conventionally JWT. When re-signing, the editor writes typ JWT into the header alongside your chosen algorithm, matching what standard libraries emit, so downstream validators see a normal-looking header.