JWT HS256 builder
Use local Web Crypto to generate HS256 JWT, display the Header, Payload, and signature input, and show a clear warning that the demo secret is not for production use.
How to use JWT HS256 builder
JWT HS256 builder only processes input in the current browser; it does not upload, connect to the network, or write to persistent storage.
Enter Header/Payload
By default, it loads the 11DZ Demo user, iat/exp, and HS256 Header.
Confirm the secret
For public tutorials, the secret is displayed in plain text, and the warning not to use it in production must be acknowledged.
Generate and review
Generate a copyable JWT; alg none is provided only as a structural example with an explicit warning.
Limitations and Notes
- The default secret is for public teaching only and must never be used in production or for real identity authentication.
- The tool does not validate JWT, import RSA/ECDSA private keys, or access remote JWK.
- The time and permission semantics of the Payload still need to be validated by the actual server.
FAQ
Why isn’t the secret masked?
This is a public teaching demo and must be directly runnable by users; real sensitive inputs should be protected according to the use case.
Are RSA signatures supported?
Not supported; this tool only generates local HS256.
Is alg none secure?
It does not provide authentication; it only displays the unsigned structure and clearly issues a warning.