JWT Decoder & Encoder
Decode, encode, and verify JWT tokens. Analyze payload claims and validate signatures — all processing happens in your browser.
Paste a token or load the sample to inspect its structure.
Decoded
Header
Metadata such as the algorithm and token type.
Payload
Edit claims and timestamp values.
Signature
Enter a key to verify the signature or create a new token.
HMACHS256
About JWT Decoder & Encoder
Read JWT claims, verify signatures and create signed tokens.
Decode a token to inspect header/payload. Select the matching algorithm and supply its secret or key before verification or signing.
Use decoded claims to debug a test authentication flow; remove real credentials before copying results.
The calculation or rendering runs in this browser tab. Copy, download and share actions make the chosen output available outside this tab.
Worked example
- Input / settings
- Header {"alg":"HS256"}; payload {"sub":"demo"}; a test secret
- Action
- Sign and then verify with the same secret
- Result
- A three-part token whose decoded sub is demo and whose signature verifies with that secret.
Scope and limits
- Supports HMAC, RSA, RSA-PSS, ECDSA and EdDSA where the browser supports them. Invalid JSON, malformed tokens and incompatible keys report an error.
Frequently asked questions
- Does decoding prove authorization?
- No. Decoding displays claims. A signature check alone also does not implement your service’s issuer, audience, revocation or authorization policy.
For account, sync, advertising and analytics data flows, see the Privacy Policy.