JWT Encode Decode token
Decode the header and payload of a JSON Web Token to inspect claims, or build an HMAC-signed test token in the browser.
What this tool does
A JSON Web Token carries authentication and authorization data in three dot-separated parts: header, payload, and signature. The first two parts are JSON encoded with URL-safe Base64, which means they are readable by anyone; the token is signed, not encrypted.
The header states the signing algorithm (alg) and token type (typ). The payload holds claims: exp for expiry, iat for issued-at, nbf for not-before, sub for subject, iss for issuer, and aud for audience, among others. Time claims are usually Unix timestamps in seconds, which are hard to read at a glance, so this tool also renders them as human-readable dates.
The signature proves the token has not been tampered with. Decode mode here parses the structure and shows the claims but performs no signature verification. Encode mode builds an HMAC signature in the browser so you can produce a token for testing.
When to use it
Use it to check when an issued token expires, to review role or scope claims while debugging an authorization failure, to compare the tokens seen by the frontend and the backend, or to mint a short-lived token for API testing. A surprising number of authentication problems turn out to be nothing more than an expired exp value.
Input and output examples
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiZXhwIjoxNzY3MjI1NjAwfQ.signature
header: alg HS256, typ JWT / payload: sub 1234, exp 1767225600 (2026-01-01 00:00:00 UTC)
Timestamp claims are shown as readable dates alongside the raw value.
header {"alg":"HS256"} plus payload {"sub":"test"} plus a secret
A three-part signed token
Encode direction, for building test tokens.
Notes and limitations
Be careful with production tokens. Processing happens in your browser, but a valid token represents a live session, so treat it as a credential. Decoding successfully does not mean a token is valid: signature verification must happen on the server with the secret key, and a server that accepts alg set to none has a serious vulnerability. Signatures generated here are for testing only.
Frequently asked questions
Is a JWT encrypted?
No. The header and payload are only Base64 encoded and can be read by anyone, so never place passwords or sensitive personal data in the payload. The signature prevents tampering; it does not hide content.
Does this tool verify the signature?
No. Decode mode parses structure and claims only. Verification requires the secret key and must be done server-side.
The token is expired but requests still succeed.
The server may not be validating expiry, or it may allow a clock skew window. Review the server-side verification logic.