🔐 JWT Decoder & Encoder
Read what a JSON Web Token contains, verify its HS256 signature with your secret, or create a new token. Everything runs in your browser — nothing is uploaded.
❓ Frequently asked questions
Is my secret sent anywhere?
No. Signing and verifying use the Web Crypto API in your browser; the secret never leaves your device.
Which algorithm is supported?
Decode works for any JWT. Encode and verify use HS256 (HMAC-SHA256), the most common symmetric signing algorithm.
Can I read a token without the secret?
Yes — the header and payload are just base64url-encoded JSON, so you can read them without a secret. Verifying the signature, though, requires the secret.
📚 How to use
- Paste a token on the Decode & Verify tab to read its claims.
- Add your secret and click Verify HS256 to check the signature.
- On the Create token tab, edit the payload JSON, enter a secret and generate a signed token.
About this tool
A JWT looks like gibberish but it is three base64url-encoded parts: a header (algorithm), a payload (claims like user id and expiry), and a signature. This tool decodes the first two so you can see exactly what an app is putting in a token.
The signature is what stops someone from forging a token. With your secret you can verify it was really signed by you — useful when debugging auth on your own API.
Nothing is uploaded: decoding, signing and verifying all happen locally with the browser's built-in Web Crypto API.