JWT Encoder and Decoder

Encode and decode JSON Web Tokens (JWT). Easily inspect JWT headers, payloads, and signatures.

Configuration

Mode

Select the mode.

JWT Token

Invalid Signature

Header

Payload

Signature

About JWT Encoder and Decoder

Decode, verify, and create JSON Web Tokens (JWTs) online. Paste a token to instantly inspect its header and payload as formatted JSON, verify its signature against your HMAC secret, or build and sign a new token from a JSON payload.

Unlike server-based JWT tools, everything here happens in your browser — tokens and secrets are never transmitted, which makes it a safer way to debug authentication issues.

Key Features

  • Decode JWT header and payload to readable JSON
  • Verify token signatures with an HMAC shared secret
  • Create and sign new tokens from a JSON payload
  • Tokens and secrets never leave your browser

Frequently Asked Questions

What is a JWT?

A JSON Web Token is a compact, URL-safe token made of three Base64Url-encoded parts — header, payload, and signature — commonly used for authentication and secure information exchange between services.

Is it safe to paste my JWT into this tool?

The token is decoded locally in your browser and never sent to a server. As general hygiene, still avoid sharing production tokens and secrets anywhere you don’t control.

Can this tool verify a JWT signature?

Yes. Enter the shared secret used to sign the token and the tool verifies the HMAC signature locally, telling you whether the token is authentic and untampered.

Why does my decoded JWT show readable data?

JWT payloads are Base64Url-encoded, not encrypted — anyone with the token can read its claims. The signature only proves integrity, so never put secrets in a JWT payload.