JWT Encoder and DecoderNew

Decode, verify, and generate JSON Web Tokens (JWTs) in your browser. Paste a token to examine its header and payload, optionally verify its HMAC signature with a shared secret, or generate a signed token from JSON.

Encoded JWT

What is a JSON Web Token?

A JSON Web Token (JWT) is a compact format for transmitting claims as JSON. A commonly used signed JWT consists of three dot-separated Base64URL-encoded parts:

header.payload.signature

Header — describes the token type and signing algorithm, such as HS256.
Payload — contains claims such as the subject (sub), issuer (iss), expiration (exp), and issued-at time (iat).
Signature — helps the recipient detect tampering and authenticate the signer when the correct key is used.

JWTs can also be encrypted (JWE). This tool handles three-part signed tokens (JWS), not five-part encrypted JWTs.

How to decode and verify a JWT

Select Decode / verify and paste a three-part token.
Select Decode JWT to display its header and payload as formatted JSON.
Inspect claims such as exp, nbf, iss, and aud.
For tokens using HS256, HS384, or HS512, enter the shared secret and select Verify HMAC signature.

Decoding is not verification. A token's payload is readable without a secret and may be altered or forged. This tool does not automatically validate issuer, audience, authorization rules, or all application-specific requirements.

How to encode and sign a JWT

Select Encode / sign.
Choose HS256, HS384, or HS512.
Enter the header and payload as valid JSON objects.
Enter an HMAC signing secret and select Generate signed JWT.
Copy the resulting token using the copy button.

For example, a payload might contain:

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1600000000
}

The iat, exp, and nbf claims use NumericDate values: seconds since the Unix epoch, not milliseconds. The tool does not automatically generate or refresh expiration claims.

JWT security considerations

JWT payloads are encoded, not encrypted. Anyone with a token can usually read its claims. Avoid putting passwords, access secrets, or other sensitive information in the payload.
Signature verification matters. Never trust decoded data as proof of identity or permissions without validating the signature and relevant claims.
Use strong secret keys. For HMAC algorithms, the JWT specification requires keys at least as long as the hash output: 256 bits for HS256, 384 bits for HS384, and 512 bits for HS512. The generator accepts arbitrary nonempty strings for test compatibility; that does not make short secrets secure.
Keep signing secrets private. The tool uses the browser's Web Crypto API locally; it does not transmit JWTs or secrets to a verification server. Avoid entering production credentials in untrusted browser environments.
Other algorithms are not verified here. Tokens signed with RS256, ES256, and similar asymmetric algorithms can be decoded for inspection, but require another verifier with a trusted public key.

Frequently asked questions

Can a JWT be decoded without a secret?

Yes. The header and payload of an ordinary signed JWT are Base64URL-encoded, not encrypted. A secret is required to verify an HMAC signature, not to read the claims.

Does decoding a JWT mean it is valid?

No. Successfully decoding JSON does not authenticate a token. Even a valid HMAC signature does not establish that the issuer, audience, expiration, or permissions are acceptable for your application.

Which JWT algorithms does this tool support?

It can decode three-part JWTs with JSON headers and payloads for inspection. It can generate and verify HMAC signatures using HS256, HS384, and HS512 only. It does not verify RSA or ECDSA signatures or decrypt JWE tokens.

Is the JWT sent to a server?

No. Encoding, decoding, and HMAC signing/verification run locally in the browser. The page itself may load normal website resources, so do not treat a browser session as a dedicated secret-management environment.

HMAC generator — Calculate the HMAC-SHA256, SHA384 and SHA512 values that HS256, HS384 and HS512 use.
Base64 encoder and decoder — Encode and decode ordinary Base64 text.
SHA-256 hash calculator — Calculate SHA-256 message digests.
Password generator — Generate random passwords.