Security & Crypto StudiosRuns locally in your browser · No signup

JWT, OAuth PKCE & TOTP Auth Studio

Decode JWT headers & OIDC claims locally, verify and mint HS256/384/512 tokens via Web Crypto, generate OAuth 2.0 PKCE S256 challenges, and test RFC 6238 TOTP 2FA codes.

100% Local Browser Engine · Zero Uploads3 Workspaces

JWT Inspector, Signer & Verifier: Decode JWT headers & claims with exp/nbf countdowns, verify HMAC-SHA256/384/512 signatures locally, or mint signed test tokens.

Encoded JWT (Bearer prefix stripped automatically)

Verify HMAC Signature (HS256 / HS384 / HS512)

Decoded Header & Payload

Active — expires in 1674793m 33s

2030-01-01T00:00:00.000Z

JOSE Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Claims Payload

{
  "sub": "user_12345",
  "name": "Nadia Belkacem",
  "role": "admin",
  "iat": 1761264000,
  "exp": 1893456000
}

Registered & Custom Claims Reference

Claim	Value	Meaning / Decoded Timestamp
sub	user_12345	Subject — user or entity identified by the token
name	Nadia Belkacem	Application-specific custom claim
role	admin	Application-specific custom claim
iat	1761264000	2025-10-24T00:00:00.000ZIssued At — Unix epoch seconds when the token was minted
exp	1893456000	2030-01-01T00:00:00.000ZExpiration Time — Unix epoch seconds after which token must be rejected

Was this tool helpful?

What is JWT, OAuth PKCE & TOTP Auth Studio?

JWT, OAuth PKCE & TOTP Auth Studio decodes JOSE headers and OIDC claims with exp/nbf countdowns, signs and verifies HS256/384/512 JWTs locally, generates RFC 7636 PKCE S256 code_verifier/code_challenge pairs, and computes live 6-digit RFC 6238 TOTP 2FA tokens.

How to use JWT, OAuth PKCE & TOTP Auth Studio in 3 steps

1
Switch between JWT, OAuth PKCE, and TOTP 2FA modes
Paste a Bearer token, generate a PKCE S256 pair, or enter a Base32 MFA seed.
2
Inspect claims and verify signatures
Check expiration status, verify HMAC secrets, or watch 30-second TOTP rotation.
3
Copy verified tokens or challenges
Use directly in Postman, cURL, or automated auth integration tests.

Key features and benefits

Covers all three modern web auth primitives (JWT, OAuth 2.0 PKCE, and TOTP MFA) in one private studio.
Never transmits production or staging Bearer tokens over the network.

Common use cases

Debugging expired or mis-signed OIDC id_tokens and access_tokens.

Testing OAuth 2.0 authorization-code + PKCE flows and staging MFA seeds.

Why browser-based works better

JWT, OAuth PKCE & TOTP Auth Studio consolidates related security & crypto studios workflows into one cohesive, multi-mode browser studio — eliminating tab-hopping across fragmented single-purpose tools.

Every mode executes locally using Web APIs and audited client-side libraries, so private files, tokens, and source code never leave your device.

You might also need

Continue this workflow with nearby browser-based tools so you can validate, convert, and ship output without context switching.

JWT, OAuth PKCE & TOTP Auth Studio FAQs

Quick answers about the workflow, privacy, and where this tool fits in a broader job.

Why shouldn't I paste staging JWTs into server-backed decoders?

Active Bearer tokens grant API access until exp; decoding in a 100% client-side studio eliminates token leakage risk.

Keep the workflow moving with nearby tools that solve the next likely step.

Built and maintained by

Free AI Tools Engineering Team

Browser Tooling & Web Platform Engineering

Last updated: October 2026

Tested in Chrome, Firefox, and Safari on desktop and mobile.

Video demo

What is JWT, OAuth PKCE & TOTP Auth Studio?

JWT, OAuth PKCE & TOTP Auth Studio FAQs

Related free tools