JWT Decoder & Encoder
Decode and encode JWT tokens (HS256). Inspect header, payload, and expiration claims. 100% local, no token is ever sent to a server.
About: JWT Decoder & Encoder
This JWT decoder shows the header and payload of a JSON Web Token as a readable table, converts the exp, iat and nbf claims to dates, and flags whether the token has expired. Encode mode works the other way: write a JSON payload and a secret, and the tool signs the token with HS256. Handy for debugging authentication, checking a user's roles or scopes, or creating a test token. Decoding and signing both stay in your browser.
Features
- Decodes the header and payload, with every claim copyable on its own.
- Converts exp, iat and nbf claims to local time, with an Expired, Valid or Not yet valid badge.
- Color-coded token (header, payload, signature) so each segment stands out at a glance.
- Encodes a JSON payload into an HS256-signed token with your secret, using the Web Crypto API.
- Loads a sample token in one click, and handles accented characters and emoji correctly.
How to use it
- Paste your JWT into the field, or click Example to load one.
- Read the decoded header and payload, and check the expiry status next to the dates.
- To create a token, switch to the Encode tab and enter a JSON payload and a secret key.
- Copy the generated token with the copy button.
Questions about usage
No. Decoding and signing happen entirely in your browser, and no token or secret is transmitted. The field contents are, however, stored in the page URL, so avoid sharing that link if it contains a real token or a production secret.
No. The decoder reads the header and payload, which are only Base64URL-encoded, but it does not verify the signature, since that requires the secret or public key. A token decoded here is not proven to be authentic.
The encoder signs with HS256 only (HMAC with SHA-256) using a shared secret. The decoder reads any token in the header.payload.signature format, whatever algorithm its header declares.