Omikuji Tools Text & Dev

JWT Decoder & Hash Generator

Read a JWT and its expiry, verify its signature, and hash text or files to compare checksums. Tokens, keys and files are never sent anywhere.

Features

  • Pretty-print the JWT header and payload with the meaning of each claim, and exp/iat/nbf as dates with time remaining
  • Verify HS256/384/512 with a secret, or RS, PS, ES and EdDSA with a public key (PEM, JWK, JWKS with kid matching)
  • MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or files at once, with HMAC and hex/Base64 output
  • Paste a published checksum (even sha256sum output) to compare. Large files are read in chunks and never uploaded

Use cases

Debugging APIs

Check an access token's claims, scopes and expiry when you get a 401.

Checking signing keys

Paste your identity provider's JWKS and confirm the token was signed with the right key.

Verifying downloads

Compare the SHA-256 of an ISO or installer with the published value.

Webhook signatures

Compute HMAC-SHA256 of a payload with the shared secret and compare it with the received signature.

Privacy

Tokens, keys, text and files are processed entirely in your browser (WebCrypto and WebAssembly) and never sent to a server. Nothing you enter is stored; only the selected tab is remembered.

FAQ

Is it safe to paste a production token?

This page never sends or stores tokens or keys. Still, be careful with screen sharing and screenshots, and press Clear when you're done. You can also test with an expired token.

Which signature algorithms are supported?

HS256/384/512 (shared secret), RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA (Ed25519). Public keys can be PEM (BEGIN PUBLIC KEY), JWK or JWKS (the key matching kid is picked automatically).

Can it hash large files?

Yes. Files are read 4 MB at a time and all five hashes are computed in one pass, so even multi-gigabyte files use little memory. Speed depends on your device.

Is MD5 or SHA-1 still OK to use?

They're fine for detecting corrupted downloads or when a publisher only lists MD5. For protection against tampering, signatures or password storage, use SHA-256 or stronger, purpose-built methods.

Related tools

Base64 Converter HTML Escape / Unescape Password Generator Regex Tester HTTP Status Codes Mojibake Generator

Tokens, keys and files are processed only in this browser and never sent or stored.