Encoding
JWT Encoder/Decoder
Encode and decode JWT tokens — header, payload, HMAC signing, and standard claims.
Signed examples (all but none) require HTTPS — this page is currently loaded without HTTPS.
For RS/PS/ES a key is generated automatically and temporarily — for demonstration only, it cannot be reused.
Signed examples (all but none) require HTTPS — this page is currently loaded without HTTPS.
Claims
A JWT (JSON Web Token) is a compact format for transmitting signed data, made of three dot-separated parts: a header, a payload, and a signature. This tool decodes any JWT and shows all three parts, and can also build a new token signed with HMAC.
Decoding does not verify the signature — reading a token's contents needs no secret key. Verifying the signature only matters when you need to trust the token as genuine.
How to use it
- Decode: paste a JWT and the tool splits it into header, payload, and signature, highlighting standard claims like exp, iat, and sub.
- Encode: fill in the header and payload, provide a secret, and get a signed HMAC token (HS256/HS384/HS512) back.
- Check expiry: the exp claim is shown as a normal date, so you can immediately tell if a token has expired.
Common uses
- Debugging authentication issues by inspecting exactly what a request's token contains.
- Checking which claims (roles, permissions, expiry) your backend issues.
- Generating a test token for local development without running an auth server.
Things to keep in mind
A JWT is not encrypted, only Base64URL-encoded — anyone can read the payload. Never put passwords or other secrets in it.
The signature protects against tampering, not against being read. For confidentiality you need extra encryption (JWE) or an HTTPS transport.
Article about this tool: JWT: token structure and what "decoding" a JWT actually means
Frequently asked questions
Does decoding a JWT verify its signature?
No. Decoding just base64url-decodes the header and payload so you can read the claims — it does not prove the token is authentic. To actually verify a signature you need the correct secret or public key entered here.
Is it safe to paste a real JWT into this tool?
Decoding and signing happen entirely in your browser — the token and any secret you enter are never sent to a server. Still, treat tokens from production systems carefully, since anyone who sees a decoded JWT can read its claims.
Why does my token show as expired even though it still works in my app?
The Expired/Valid indicator here only compares the exp claim to the current time — it doesn't check clock skew tolerances or other validation rules your server or library might apply.
What is the "alg: none" algorithm-confusion attack?
If a backend naively trusts the alg field from a token's header, an attacker can swap it to none, strip the signature — and a token with arbitrary data will pass verification. Robust libraries require the expected algorithm to be specified explicitly at verification time.
Why shouldn't I store a JWT in localStorage for sensitive sessions?
localStorage is accessible to any JavaScript running on the page, so it's vulnerable to XSS — a malicious script can steal the token. For session tokens, an httpOnly cookie, which JavaScript can't access, is safer.