JWT Encoder & Decoder

About this tool

A JSON Web Token (JWT) is an open standard (RFC 7519) for representing claims between two parties. A JWT consists of three Base64URL-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims such as user ID, roles, and expiration), and the Signature (used to verify the token has not been tampered with). JWTs are most commonly used for authentication—a server issues a signed token after login, and the client sends it with every subsequent request. This free browser-based tool both encodes and decodes JWTs: paste a token to instantly decode its Header and Payload and see its expiration status, or edit the Header/Payload/secret directly to encode a brand-new HS256, HS384, or HS512 token. It also verifies HMAC signatures against a secret you provide—all without sending your token to any server. It serves as a privacy-friendly alternative to jwt.io for everyday token encoding, inspection, and debugging.

How to use

1. 1Paste your JWT token into the input field — the Header and Payload are decoded instantly.
2. 2Check the "exp" field in the Payload to see if the token has expired.
3. 3To verify a signature: enter your HMAC secret in the Verify section and click "Verify".
4. 4To encode a new token: edit the Header, Payload, or Secret fields directly — the Encoded Token updates and re-signs in real time with your chosen algorithm (HS256/384/512).

Frequently asked questions

How do I encode (create) a JWT?

Edit the Header and Payload JSON directly, choose an algorithm (HS256, HS384, or HS512), and enter a secret. The Encoded Token field updates automatically with a freshly signed token — no separate "generate" button needed. This all happens locally in your browser.

Is it safe to decode a JWT in the browser?

Decoding just reads the Base64URL-encoded payload and is entirely local. The signature is not checked during decoding unless you provide a secret. Never paste a token that grants real access to production systems into any online tool.

What is the difference between decoding and verifying a JWT?

Decoding simply reads the header and payload—it does not check whether the token is valid or trusted. Verification uses the secret (or public key) to confirm the signature, proving the token was issued by a trusted party and has not been modified.

What are standard JWT claims?

Common registered claims include: iss (issuer), sub (subject / user ID), aud (audience), exp (expiration time as Unix timestamp), nbf (not before), iat (issued at), and jti (JWT ID). Custom claims can be added freely.

What is the difference between JWT and a session cookie?

A traditional session stores data server-side and gives the client an opaque ID. A JWT stores the claims client-side in a signed token—the server needs no session database to verify it, which makes JWTs popular for stateless, distributed architectures and microservices.