JWT Encoder / Decoder
Decode a token's header and claims, or encode a new one signed with HS256/384/512. Nothing is sent anywhere. Decoding does not verify the signature.
[ TOKEN ]
[ HEADER ]
// waiting for input
[ PAYLOAD ]
// waiting for input
About JWT Encoder / Decoder
A JSON Web Token is three base64url segments — header, payload, and signature — separated by dots. This tool decodes those segments so you can inspect the claims, and can also sign a new token with an HMAC secret for testing.
How to use it
- Paste a JWT into the input to see its decoded header and payload.
- Check claims such as exp, iat, iss, and sub against what you expect.
- To create a token, switch to encode mode, edit the header and payload JSON, and enter a secret.
- Copy the generated token for use in your tests.
Frequently asked questions
- Is it safe to paste a JWT here?
- The token is decoded entirely in your browser with JavaScript and is never sent to a server. Still, avoid pasting production tokens that are currently valid — treat any token you share anywhere as potentially exposed.
- Does this verify the signature?
- No. Decoding shows you what a token contains, but it does not check that the signature is valid. Signature verification needs the issuer's secret or public key and should be done by your backend.
- Which signing algorithms are supported?
- Encoding supports the HMAC-SHA family: HS256, HS384, and HS512. Asymmetric RS and ES signing is not supported.