Paste a JWT to inspect its header, payload, and signature. Or encode your own tokens with HMAC keys.
Paste JWT Token
Payload (JSON)
Decoded Token
Header
Payload
Signature
Encoded JWT
About JWT Decoder & Encoder
A free online JWT (JSON Web Token) decoder and encoder. Decode any JWT to inspect its header, payload, and signature, or encode your own tokens with HMAC-SHA keys. All processing happens in your browser — your tokens never leave your device.
Key Features
Instant Decoding — Decode JWT tokens in milliseconds with no server calls
Token Status — Automatically shows if a token is expired, valid, or not yet active
Full Inspector — View header, payload, and signature as formatted JSON
Multiple Algorithms — Encode tokens with HS256, HS384, or HS512
Web Crypto API — Uses the browser's native cryptographic functions for secure encoding
100% Client-Side — Your tokens and secret keys never leave your browser
How to Use
Paste your JWT token into the input field.
Click Decode Token to see the header, payload, and signature.
Check the token status — it shows if the token is expired or valid.
To encode, switch to the Encode tab, enter your JSON payload, secret key, and algorithm.
Use Cases
API Debugging:Decode JWTs from API responses to inspect claims, check expiration, and debug authentication issues.
Token Testing:Generate test tokens with specific claims for development and staging environments.
Security Auditing:Inspect JWTs from logs or network requests to verify claims and check for security issues.
OAuth Flows:Debug tokens from OAuth providers like Auth0, Firebase, or AWS Cognito during integration.
Tips
Tip: Press Ctrl+Enter (or Cmd+Enter on Mac) to quickly decode a token without clicking the button.
Tip: JWTs are not encrypted — anyone can decode the header and payload. Only the signature is cryptographically secured.
Alternatives
jwt.io — The official JWT debugging site
JWT Debugger (Chrome Extension) — Browser extension for quick decoding
Postman — API client with built-in JWT decoding
FAQ
A JWT is a compact, URL-safe token format used for securely transmitting information between two parties as a JSON object. It consists of three parts: a header (algorithm and token type), a payload (claims/data), and a signature (for verification).
Yes. The header and payload of a JWT are only Base64url-encoded, not encrypted. Anyone can decode them to read the contents. The secret key is only needed to verify the signature — which proves the token hasn't been tampered with.
This tool is designed for debugging and testing. It runs entirely in your browser, so your tokens are never sent to any server. However, never share production secret keys in shared environments.
This tool supports HMAC-SHA algorithms: HS256, HS384, and HS512. These use a shared secret key for both signing and verification, which is common for server-to-server authentication.
The tool automatically checks the `exp` (expiration time) claim in the payload. If the current time is past the expiration timestamp, the token is marked as expired. Tokens without an `exp` claim are shown as having no expiration.