JWT Encoder/Decoder
Decode any JWT (JSON Web Token) to see its header and payload, or encode your own signed JWT from a header, payload, and secret — entirely in your browser, using the native Web Crypto API. Decoding does not verify the signature; encoding supports the HMAC family (HS256/HS384/HS512) only.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How to use
- Decode tab: paste a JWT (three base64url segments separated by dots) — the header and payload decode instantly as formatted JSON, and any exp/iat/nbf claim shows its human-readable date too.
- Encode tab: edit the header/payload JSON and a secret — a signed JWT is generated instantly using the algorithm from the header's "alg" field.
FAQ
Does decoding verify the signature?
No — decoding only reads the header and payload, which requires no secret/key since they're just base64url-encoded JSON, not encrypted. Verifying a signature requires the issuer's secret or public key, checked server-side — never trust an unverified JWT's contents for authorization.
Which algorithms does the encoder support?
HS256, HS384, and HS512 — HMAC algorithms, signed with the Web Crypto API using the secret you provide. RS256/ES256 and other asymmetric algorithms need a private key (PEM parsing, key format handling) and aren't supported here.
Is my token or secret sent anywhere?
No — both decoding and encoding happen entirely in your browser. Still, treat real production tokens/secrets carefully in general — avoid pasting live secrets into any online tool on a shared or untrusted machine.
Why do I get an error decoding it?
A valid JWT has exactly 3 dot-separated segments, each valid base64url-encoded JSON for the header/payload — if a segment is missing, truncated, or not valid JSON, decoding fails with the specific reason shown.