JWT Decoder & Encoder
Decode, verify and generate JSON Web Tokens: claims breakdown, signature check and signing, entirely client-side.
Signature verification (optional)
Your token and key are used in this browser only. Nothing is uploaded or stored.
Three steps, no reading required.
Paste a token
Paste a JWT in the Decoder tab. The header and payload decode instantly, with a claims breakdown and expiry check.
Verify the signature
Enter the secret (HS256/384/512) or a public key as PEM or JWK (RS, PS, ES, EdDSA) to check the signature in your browser.
Or sign a new token
Switch to the Encoder, edit the header and payload, add a secret or private key, and copy the signed JWT.
Try it with a sample.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkRldlV0aWxzTm93IiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Paste a live credential into a stranger's site
- Tokens are credentials, and many decoders send them to a server
- Decode only, with no way to check the signature
- Logs may keep your token
Inspect it without sharing it
- Decode, verify and sign tokens in your browser; nothing is uploaded
- HS, RS, PS, ES and EdDSA via Web Crypto, with PEM or JWK keys
- Claims breakdown, expiry check and key-pair generation built in
Questions worth answering upfront.
No. The JWT is decoded entirely in your browser. Your token is never uploaded, logged or stored — important, since tokens are sensitive credentials.
Yes, if you give it a key. Paste the token, then enter the shared secret (HS256/384/512) or a PEM public key (RS, PS, ES). The check runs in your browser with the Web Crypto API, so the key never leaves your device. Without a key it only decodes the header and payload.
A JWT has a header (algorithm and token type), a payload (the claims), and a signature — each Base64URL-encoded and separated by dots.
Decoding is safe because it stays in your browser, but a JWT is still a credential. Avoid sharing tokens in screenshots or with others, and prefer expired or test tokens where possible.
Yes. Open the Encoder tab, choose an algorithm, edit the header and payload JSON, and enter an HMAC secret or a private key (PEM or JWK). The signed token appears as you type. Generate creates a random secret or a fresh key pair, so you can test without real keys.
Paste the token, then enter the shared secret for HS256, HS384 or HS512 tokens, or a PEM public key for RS, PS and ES tokens. The page checks the signature with your browser's Web Crypto API and reports whether it matches. The key is never sent anywhere or saved.
People who use this also reach for
Look it up
Guides that pair with this tool
Need another tool?
36+ browser-based utilities — all free, all private, nothing to install.