JWT Encoder / Decoder

JWT Encoder & Decoder — Decode and Sign JSON Web Tokens Online

Paste any JSON Web Token and instantly see its decoded header, payload claims, and signature segment — or switch to encode mode to build and HMAC-sign a brand-new token. This free online JWT tool is the fastest way to debug authentication issues and to generate test tokens: inspect the algorithm, issuer, audience, and expiry of a token, or mint your own signed JWT without writing a single line of code.

Everything runs locally in your browser. Decoding never transmits your access tokens, ID tokens, or refresh tokens, and encoding signs the token on-device using the Web Crypto API — so your secret and claims are never uploaded or logged, which matters when you are working with production credentials. Timestamps like exp, iat, and nbf are translated into human-readable dates so you can immediately see whether a token has expired.

How to Decode or Encode a JWT

Choose decode or encode

Use the toggle to inspect an existing token, or to build and sign a new one from scratch.
Paste a token or edit the claims

In decode mode, paste the JWT to see its header and payload. In encode mode, edit the header and payload JSON directly.
Pick an algorithm and secret

For encoding, choose HS256, HS384, or HS512 and enter your HMAC signing secret — the token re-signs live as you type.
Inspect or copy

Review standard claims (iss, sub, aud, exp, iat) with readable expiry dates, or copy the freshly signed token to your clipboard.

Why Use This JWT Encoder / Decoder?

Encode and decode in one tool

Debug a pasted token or generate and sign a new one without switching sites.
Client-side signing

Tokens are HMAC-signed locally with the Web Crypto API — your secret and claims never leave your browser.
HS256, HS384 & HS512

Sign with any HMAC-SHA algorithm, using a plain-text or base64-encoded secret.
Human-readable timestamps

exp, iat, and nbf claims are converted to local dates with a clear expired / valid indicator.
Live re-signing & validation

The token updates instantly as you edit the header, payload, or secret, and invalid JSON is flagged immediately.
Works with any provider

Access tokens, ID tokens (OIDC), and custom JWTs from Auth0, Firebase, Cognito, Keycloak, and more.

Frequently Asked Questions

Can I create and sign a new JWT with this tool?

Yes. Switch to encode mode, edit the header and payload JSON, choose an HMAC algorithm (HS256, HS384, or HS512), and enter a secret. The tool signs the token locally with the Web Crypto API and gives you a copy-ready JWT.

Is it safe to paste a real JWT or secret into this tool?

Yes. Both decoding and signing happen entirely in your browser via JavaScript — neither the token nor your signing secret is ever sent to a server. Still, treat live tokens and secrets as sensitive and avoid sharing screenshots.

Which signing algorithms are supported?

Encoding supports the HMAC family — HS256, HS384, and HS512 — which covers the most common symmetric-key JWTs. Asymmetric algorithms like RS256 and ES256 require a private key and are typically signed on your server.

Does decoding a JWT verify its signature?

No. Decoding only reads the Base64URL-encoded header and payload, which anyone can do. Signature verification requires the secret or public key and should happen on your server.

How can I tell if my JWT is expired?

Look at the exp claim — this tool converts it to a readable date automatically and flags whether it is in the past. If exp is earlier than now, the token is expired and your API will reject it.

What are the three parts of a JWT?

A JWT has a header (algorithm and type), a payload (the claims), and a signature — separated by dots. The first two parts are Base64URL-encoded JSON; the third is the cryptographic signature.

JSON Formatter & Validator Beautify, minify, and validate JSON payloads with live syntax highlighting.
Syntax Converter (JSON to Code) Convert raw JSON into type-safe TypeScript, Dart, Python, Go, Kotlin, C#, or Rust models instantly.
Excel ⇄ JSON Converter Convert Excel and XLS spreadsheets to JSON, or turn JSON arrays into downloadable .xlsx workbooks — batch, multi-sheet, and fully in-browser.
PDF to JSON Converter Extract text, page structure, and metadata from PDF files into clean structured JSON — batch multiple PDFs at once, all in your browser.
Image to Text (OCR) Copy text from images, screenshots, photos, and scanned documents in 30+ languages — batch many images at once, powered by Tesseract OCR running entirely in your browser.
PDF Unlocker Remove owner-password restrictions or strip a known user password from PDF files — batch multiple PDFs at once, entirely in your browser.
Base64 Encoder / Decoder Encode strings and binary images to Base64 format or decode them back safely.
URL Encoder / Decoder Encode query parameters and paths for query strings, or decode URI-encoded targets.
UTM Campaign URL Builder Add UTM tags (source, medium, campaign) to any link, build tracked campaign URLs in bulk, or parse an existing URL's parameters — all in your browser.
Regex Tester Test regular expressions live with highlight overlays, match group breakdowns, and a library of common patterns (email, URL, phone, IPv4, hex color).
Password & Hash Generator Create cryptographically secure passwords, UUIDs, MD5 and SHA256 hashes.
JSON ⇄ YAML Converter Convert JSON to YAML and YAML to JSON instantly in your browser — ideal for Docker Compose, Kubernetes manifests, and CI/CD pipeline configs.
YAML Formatter & Validator Format, beautify, and validate YAML in your browser — with dedicated builders and schema checks for OpenAPI specs and GitLab CI (.gitlab-ci.yml) pipelines.
JSON ⇄ CSV Converter Turn JSON arrays into spreadsheet-ready CSV files or parse CSV exports back into structured JSON, with delimiter options and type detection.
SQL Formatter & Minifier Beautify messy SQL queries with dialect-aware formatting for PostgreSQL, MySQL, SQLite, and more — or minify them to a single line.
XML Formatter & Validator Validate XML syntax and beautify or minify documents with clean indentation — built for RSS feeds, sitemaps, and SOAP payloads.
Text Diff Checker Compare two blocks of text, code, or JSON side-by-side and highlight every added or removed line — nothing ever leaves your browser.
String Case Converter Convert text to camelCase, snake_case, kebab-case, PascalCase, CONSTANT_CASE, Title Case, and more — every variant generated at once.
HTML Entity Encoder / Decoder Escape special characters into named, decimal, or hex HTML entities — or decode entity-encoded strings back to plain text.
UUID / GUID Generator Generate random v4 UUIDs or time-ordered v7 UUIDs in bulk — up to 1000 at once, cryptographically secure, with copy-all and .txt export.

JWT Encoder / Decoder