JWT Encoder & Decoder Online
Create, decode and verify JWT. 100% private - runs in your browser. No token sent to server.
-
-
🔍 You Can Also Visit More Tools Categories
What is a JWT?
JWT (JSON Web Token) is a compact token format commonly used for authentication and authorization in web apps and APIs. A JWT has three parts separated by dots:
- Header: the algorithm (such as HS256 or RS256) and the token type.
- Payload: claims such as the user ID, expiry time and roles.
- Signature: used to check that the token has not been changed.
Important: The header and payload are only Base64URL-encoded, not encrypted. Anyone who has the token can read them, so never put passwords or other secrets in a JWT payload.
How to Use
Decode: Open the Decode tab, paste your token, optionally enter the HS256 secret, and click Decode JWT.
Encode: Open the Encode tab, edit the header and payload JSON, enter a secret, and click Encode & Create JWT. Copy the token from the output box.
Common JWT Claims
| Claim | Meaning |
|---|---|
iss |
Issuer of the token |
sub |
Subject, usually the user ID |
aud |
Intended audience |
exp |
Expiry time (Unix timestamp) |
nbf |
Not valid before this time |
iat |
Time the token was issued |
jti |
Unique token ID |
About This Tool
Use the Decode tab to view a token's header and payload, and to verify HS256 signatures by entering your secret. For RS256 and other algorithms you can still decode and read the token, but this tool cannot verify the signature. Use the Encode tab to create HS256 test tokens for API testing. HS256 signing uses your browser's Web Crypto API, and your token and secret are not sent to our server.
Even so, avoid pasting live production tokens or real secrets into any online tool. Use test tokens instead.
Frequently Asked Questions
Is my JWT safe here?
Yes, 100% private. Decoding and encoding runs in your browser using Web Crypto API. Token never sent to server.
Why signature invalid?
HS256 signature needs correct secret. If token is RS256, we can only decode, not verify without public key.
Can I create RS256 JWT?
Currently we support HS256 encode. RS256 decode supported, This tool currently creates HS256 tokens only.
Is a JWT encrypted? No. A standard signed JWT is only encoded, so anyone can read its payload. The signature protects against tampering, not against reading.
What is the difference between HS256 and RS256? HS256 uses one shared secret to sign and verify. RS256 uses a private key to sign and a public key to verify.