JWT Encoder/Decoder

Decode JSON Web Tokens instantly to see their Header and Payload, verify HMAC signatures, or encode a brand new JWT — all in your browser.

FreeBrowser-basedInstant

Your files are processed locally in your browser and are not uploaded to our servers. Everything happens locally in your browser, including HMAC signature verification and generation, which uses the browser's native Web Crypto API. Your token and secret key are never transmitted anywhere — the secret only ever exists in memory for the current computation.

How to use JWT Encoder/Decoder

A JSON Web Token (JWT) is a compact `header.payload.signature` string used to pass claims between systems — the header and payload are just base64url-encoded JSON, not encrypted, so decoding them needs no secret at all. Verifying or generating the signature is different: that requires the shared secret key used to compute the HMAC. This tool decodes any JWT live as you paste it, optionally verifies its HS256/HS384/HS512 signature against a secret you provide, and can also encode a brand new token from your own header and payload JSON. Everything runs locally via your browser's native Web Crypto API — the token and secret are never uploaded or sent anywhere.

Key features

  • Live JWT decoding as you paste, splitting and base64url-decoding the header and payload
  • Human-readable notes for exp, iat, and nbf claims (e.g. "expires in 2 hours")
  • Optional HMAC signature verification against a secret you provide (HS256/HS384/HS512)
  • Full JWT encoding from your own Header and Payload JSON plus a secret key
  • One-click copy for the decoded header, payload, or the final encoded token
  • Runs entirely in your browser via the native Web Crypto API — nothing is ever uploaded

Practical use cases

  • Debugging why an API call with a JWT is failing by inspecting its claims
  • Checking when a token expires before it causes an unexpected auth failure
  • Verifying a token's signature matches before trusting it in a test environment
  • Generating a test JWT with custom claims for local development

Supported formats

Accepted: jwt

Limitations

  • Signature verification and generation only support the HMAC family (HS256/HS384/HS512), not RSA- or ECDSA-based algorithms like RS256 or ES256, which use a public/private key pair rather than a shared secret
  • Decoding never validates a signature by itself — always provide the secret key if you need to confirm a token hasn't been tampered with
  • This tool works with tokens you already have or JSON you provide; it doesn't issue or manage tokens for a real authentication system

Frequently asked questions

Is decoding a JWT the same as decrypting it?
No. A JWT's header and payload are simply base64url-encoded JSON, not encrypted — anyone can decode them without any secret or key, which is exactly why sensitive data (passwords, private personal information, etc.) should never be placed in a JWT payload. Only the signature portion is cryptographically protected, and only against tampering, not against being read.
Do I need the secret key to decode a token?
No — decoding the header and payload works with no secret at all, since they're just encoded JSON. You only need the secret key if you want to verify that the token's signature is valid, or if you're encoding a new token and need to sign it.
What algorithms does the signature verification support?
HS256, HS384, and HS512 — the HMAC-based algorithms that use a single shared secret key, computed via the browser's native Web Crypto API. RSA- and ECDSA-based algorithms like RS256 or ES256 use a public/private key pair instead of a shared secret and aren't supported here.
Is my secret key ever sent anywhere?
No. All signature verification and generation is computed locally in your browser using the native Web Crypto API. The secret key never leaves your device and is never transmitted to any server.

Part of Coding Tools