logo logo-dark

JWT Decoder & Encoder

Decode a JSON Web Token, or sign a new one with HS, RS, ES and PS algorithms. Everything runs locally - your tokens and keys never leave your browser.

Decoded locally in your browser. This tool does not verify the signature.

What is a JWT Decoder & Encoder?

A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL parts - a header, a payload of claims, and a signature. Decode reads the header and payload of any token, including timestamp claims like exp, iat and nbf. Encode signs a brand-new token with the algorithm of your choice - HMAC (HS256/384/512) using a secret, or RSA, ECDSA and RSA-PSS (RS, ES, PS) using a private key. All signing happens in your browser with the Web Crypto API, so secrets and keys are never sent anywhere.

How to use it

  • Decode: paste a JWT to read its header, payload and claims.
  • Encode: pick an algorithm, enter your payload and secret (HS) or PKCS#8 private key (RS/ES/PS), then click Encode / Sign.
  • Copy any part you need. Nothing is uploaded or stored.

Features

  • Decodes any JWT into readable header and payload JSON.
  • Highlights the three token parts and flags an expired exp claim.
  • Encodes and signs new tokens with HS, RS, ES, PS or none.
  • Human-readable timestamps for iat, nbf and exp.
  • Copy buttons on every output field.
  • Web Crypto API in your browser - secrets and keys are never uploaded.

Common uses

Inspecting what an auth token actually claims while debugging a login, checking whether a token has expired, crafting a test token for a local API, or learning how a given algorithm shapes the signature. Because nothing leaves your browser, it is safe to paste a production token you are troubleshooting.

FAQ

Does decoding a JWT verify it?

No. Decoding only Base64URL-decodes the header and payload so you can read them. Verifying means checking the signature against a key, which this decoder does not do.

Is my token or key sent anywhere?

No. Decoding and signing both run in your browser with the Web Crypto API, so tokens, secrets and private keys never leave your machine.

What are the three parts of a JWT?

header.payload.signature, each Base64URL-encoded and joined with dots, as defined in RFC 7519. The header names the algorithm, the payload holds the claims, and the signature authenticates the first two parts.

Which signing algorithms can it create?

HMAC (HS256/384/512) with a shared secret, plus RSA (RS), ECDSA (ES) and RSA-PSS (PS) using a PKCS#8 private key, or none for an unsigned token.

Related tools