JWT Encoder / Decoder
Decode any JSON Web Token (JWT) to view its header and payload as formatted JSON, verify an HMAC-signed token’s signature against a shared secret, or generate a brand-new signed JWT from your own payload. HS256, HS384, and HS512 signing algorithms are supported for both verification and generation, using your browser’s built-in cryptography. RS/ES/PS-signed tokens can still be decoded but require a public key to verify, which isn’t supported here. Every operation — decoding, verifying, and signing — runs 100% client-side, so tokens and secrets never leave your device.
Frequently asked questions
What is a JWT and what’s inside it?
A JSON Web Token (JWT) is a compact, signed token made of three Base64URL-encoded parts — a header, a payload, and a signature — used to carry claims such as a user ID or expiration time that a server can verify without a database lookup.
How do I verify a JWT’s signature?
Paste the token into the Verify tab and enter the shared secret it was signed with — the tool recomputes the HMAC signature using HS256, HS384, or HS512 and confirms whether it matches.
Can this verify tokens signed with RS256 or ES256?
No — only HMAC-signed tokens (HS256, HS384, HS512) can be verified here, since those use a shared secret; RS/ES/PS-signed tokens use public/private key pairs and would need a public key, which this tool doesn’t accept.
Is it safe to paste a real JWT or secret into this tool?
Yes — decoding, verification, and signing all run locally in your browser using built-in cryptography functions, so the token and secret are never transmitted to a server or stored.
How do I generate a new JWT?
Switch to the Generate tab, enter your payload as JSON and a secret, and the tool builds a standard {"alg", "typ":"JWT"} header automatically and signs the result with your chosen HMAC algorithm.
Related tools
All Hash Generator (MD, SHA, CRC & more)
This hash generator computes MD5, SHA-1/256/512, SHA-3, RIPEMD-160, Whirlpool, CRC32 and NTLM hashes from text, instantly in your browser.
bcrypt Hash Generator & Verifier
This bcrypt generator hashes text with a configurable cost factor and verifies a value against an existing bcrypt hash, in your browser.