security_jwt_generator_validator
Decode, validate HMAC signatures, sign HMAC tokens, and build JWT claim payloads. Supports preset and standard claims, with configurable expiration and audience checks.
Instructions
JWT Decode, Validate, Sign and Claim Builder. Decode, validate (HMAC), HMAC-sign, and assemble JSON Web Tokens (RFC 7519) plus list claim-set presets and standard-claim docs, all from a single operation switch. Unlike encoding_decoding_jwt, which only decodes/inspects, this tool also verifies HMAC signatures (HS256/HS384/HS512), recomputes a signature to mint a token, and builds claim payloads with iss/sub/aud/exp/nbf/iat/jti. Asymmetric algorithms (RS/ES/EdDSA) are decoded but NOT verified or signed server-side. Time is never read from the clock: pass an explicit now (epoch seconds) for exp/nbf/iat comparisons and deltas, so identical input yields identical output. Runs locally via a bundled pure-JS HMAC implementation: read-only, non-destructive, contacts no external service, and is rate-limited (30 requests/minute for anonymous callers). Returns success, the echoed operation, and an operation-specific result object.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Action to run. decode: parse a token (no signature check). validate: verify an HMAC signature plus claim validity. signHmac: mint an HMAC-signed token. assembleClaims: build a claim payload. presets: list curated claim-set presets. standardClaims: list RFC 7519 registered-claim docs. | |
| token | No | Compact JWS string (header.payload.signature). Required for decode and validate; ignored otherwise. | |
| secret | No | Shared HMAC secret (UTF-8) used by validate to recompute the signature. Required for HMAC validation; ignored otherwise. | |
| now | No | Current time in epoch seconds for exp/nbf/iat checks on decode. Omit to compare against epoch 0 (relative-time strings only). | |
| options | No | Claim-check settings for validate (ignored for other operations). | |
| input | No | Operation payload for assembleClaims (claim fields) or signHmac (token parts). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| success | No | Always true on a 2xx response. | |
| operation | No | The operation that was executed. | |
| result | No | Operation-specific output. decode: {header,payload,signature,raw,claims,warnings,error}. validate: {valid,errors,header,payload,signatureValid,claimsValid}. signHmac: {token,header,payload}. assembleClaims: {claims,warnings}. presets: {presets[]}. standardClaims: {claims[]}. |