JWT Decoder & Encoder
Decode and encode JSON Web Tokens (JWT) for debugging authentication and authorization. Verify token structure, view claims, check expiration, and generate signed tokens with HMAC algorithms.
⚠️ Security Notice: All processing happens in your browser. This tool is for debugging only. Always verify JWTs server-side with proper secret management. Never expose private keys or secrets.
Recommended Settings
JWT Security Best Practices
- •Always verify JWTs server-side with proper secret management
- •Use strong, random secrets (≥ 256 bits for HMAC algorithms)
- •Set short expiration times (15 minutes for access tokens)
- •Never put sensitive data in JWTs - they're encoded, not encrypted
- •Reject tokens with alg: none in production environments
JWT Structure Understanding
- •Header contains algorithm (alg) and token type (typ)
- •Payload contains claims (iss, sub, aud, exp, iat, nbf, jti)
- •Signature ensures integrity - verifies token hasn't been tampered with
- •Three parts separated by dots: header.payload.signature
- •Base64URL encoded (URL-safe, no padding)
Pro Tips
- •Standard claims: iss (issuer), sub (subject), aud (audience), exp (expiration)
- •Use iat (issued at) and exp (expiration) to control token lifetime
- •JWTs are signed (integrity) not encrypted (confidentiality) - anyone can decode them
- •All processing happens client-side for privacy - your tokens never leave your browser
Most Popular
Decode mode with automatic expiration detection for debugging API tokens
When to Use This Tool
Inspect JWTs from API responses to verify claims, check expiration, and validate structure. Perfect for debugging OAuth, OpenID Connect, or custom authentication flows when tokens aren't working as expected.
Generate test JWTs with custom claims for testing your API endpoints without setting up a full authentication server. Create tokens with specific user IDs, roles, or permissions to test authorization logic.
Learn how JWTs work by decoding real tokens from Auth0, Firebase, AWS Cognito, or other authentication providers. See what claims are included and understand token structure for implementing your own JWT verification.
Check token expiration status, see when tokens were issued and when they expire. Debug 401 Unauthorized errors caused by expired tokens in your application by viewing iat and exp claims.
Generate JWTs for local development and testing without connecting to production authentication services. Create tokens with custom expiration times, user claims, and permissions for testing different scenarios.
Decode JWTs from Stripe, GitHub, Slack, or other services that use JWT for webhooks or API authentication. Understand what information is included in tokens from external services you integrate with.
How It Works
Paste JWT token into decoder (auto-removes Bearer prefix)
Token is split into 3 parts: header, payload, signature
Header and payload are Base64URL decoded and parsed as JSON
Expiration status calculated from exp claim if present
For encoding: input header JSON, payload JSON, and secret key
Token is signed using selected HMAC algorithm (HS256/384/512)
Generated JWT combines base64url(header).base64url(payload).signature
All processing happens in your browser - no data sent to servers
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Pure JavaScript for optimal performance on modern browsers.
Secure
No data collection, no tracking, no sign-up required.
Frequently Asked Questions
What is a JWT and why use it?
JSON Web Token (JWT) is a compact, URL-safe token format for securely transmitting information between parties. JWTs are commonly used for authentication (verifying who you are) and authorization (what you can access). They're stateless, meaning servers don't need to store session data - all information is in the token itself.
Are JWTs encrypted or just encoded?
Standard JWTs (JWS - JSON Web Signature) are signed but NOT encrypted. Anyone can decode and read the contents using Base64URL decoding. The signature only ensures integrity (token hasn't been tampered with) and authenticity (token was created by someone with the secret). For encryption, use JWE (JSON Web Encryption).
What's the difference between HS256, HS384, and HS512?
All three are HMAC (Hash-based Message Authentication Code) algorithms with different SHA hash functions. HS256 uses SHA-256 (256-bit), HS384 uses SHA-384 (384-bit), and HS512 uses SHA-512 (512-bit). Higher numbers provide stronger security but require more computation. HS256 is most common and sufficient for most use cases.
How do I verify a JWT signature?
Signature verification requires the same secret key used to create the token. This tool shows decoded contents but doesn't verify signatures (for security - never enter production secrets in browser tools). Always verify JWTs server-side using libraries like jose, jsonwebtoken, or your framework's JWT middleware with proper secret management.
What do exp, iat, and nbf claims mean?
exp (expiration time) is when the token expires as Unix timestamp. iat (issued at) is when the token was created. nbf (not before) is when the token becomes valid. All are in seconds since Jan 1, 1970 UTC. Tokens should be rejected if current time is after exp or before nbf.
Why does my token show as expired?
Tokens expire based on the exp claim. If current time exceeds exp, the token is invalid and should be rejected. This is a security feature to limit token lifetime. Solutions: (1) Request a new token from your auth server, (2) Implement refresh token flow, (3) For testing, generate a new token with longer expiration.
Can I put sensitive data in JWT payload?
NO! Never put passwords, credit cards, SSNs, or other sensitive data in JWTs. Anyone can decode the payload without the secret. Only include non-sensitive information like user ID, username, email, roles, or permissions. For sensitive data, use JWE (encrypted JWT) or store data server-side and include only a reference ID in the token.
Is this tool secure for production secrets?
This tool runs entirely in your browser - no data is sent to servers. However, you should NEVER enter production secrets in any browser-based tool. Use this for debugging/testing only with development tokens and test secrets. Production JWTs should be verified server-side with secrets stored in environment variables or secret managers.