All tools

JWT decoder and generator

Decode a JSON Web Token, check its expiry, verify the signature with a secret or public key, or create and sign a new token.

How to use the JWT decoder and generator

  1. Paste a token. The header, payload and dates appear right away.
  2. To check the signature, paste the secret (HS256) or the public key (PEM or JWK).
  3. Switch to Create a token to sign your own payload.

Frequently asked questions

Is a JWT encrypted?

No. A signed JWT is only encoded, so anyone can read the payload. The signature proves it wasn’t changed. Never put secrets in the payload.

Which algorithms are supported?

HS256/384/512, RS256/384/512, PS256 and ES256/384 for verifying and signing, using your browser’s Web Crypto.

Is my token sent anywhere?

No. Decoding and verifying happen on your device. Still, avoid pasting production secrets into websites.

Related tools

RAID calculatorSee how much usable space you get and how many drives can fail before you lose data.JSON formatterPaste JSON to format it, check it for errors or make it compact.Base64 encoder and decoderConvert text to Base64 and back.Password generatorCreate strong random passwords.

Everything runs in your browser. Your files and text are never uploaded.

↑↓ move · Enter open · Esc close