JWT Encoder / Decoder
Decode a JSON Web Token to see its header, payload, and signature status — or build one from scratch. Everything runs in your browser; nothing is sent anywhere.
What's a JWT, and why decode it locally?
A JWT (JSON Web Token) is what a server hands you after login, or what services pass to each other, to prove “this request is legitimately from user X” — the “Bearer token” behind most modern API and single-sign-on auth.
It's three parts joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the actual claims (who the user is, when it was issued, when it expires), and the signature is cryptographic proof that whoever holds the secret (or private key) issued it and nobody tampered with it since.
The header and payload are only base64-encoded, not encrypted — anyone can decode and read them with zero effort. That's the whole point of a tool like this: to peek inside a token while debugging without writing code. Only the signature actually needs a secret, which is why verification is the one step that asks you for one.
Encoded token
Paste a token on the left and its header, payload, and signature status will show up here.
Verification only works client-side for HMAC (HS256/384/512) tokens. RS/ES/PS-signed tokens use a public/private key pair and can't be verified with a shared secret here.