JWT Decoder & Encoder
Decode the three sections of a JSON Web Token, inspect common claims, and optionally sign or verify HMAC-based tokens. Decoding does not prove a token is authentic, and verification supports only shared-secret HS256, HS384, and HS512 signatures.
What it does
A JWT normally contains a Base64url-encoded header and payload followed by a signature. The decoded claims are readable by anyone who has the token; confidential information should not be placed in an ordinary JWT payload.
This tool can verify supported HMAC signatures when you provide the shared secret. It displays time-related claims, but it is an inspection utility—not a complete authorization decision engine.
How to use this tool
- Paste a token: Add the complete compact JWT to the decoder to inspect its header and payload.
- Verify when appropriate: For an HS256, HS384, or HS512 token, enter the correct shared secret and run verification.
- Interpret claims in context: Review issuer, audience, and time claims against the rules of the system that created the token.
Input and output
Input
- A compact JWT with exactly three dot-separated sections.
- Optionally, a shared secret for verifying an HS256, HS384, or HS512 token.
- For token creation: JSON header and payload data, a supported HMAC algorithm, and a shared secret.
Output
- Parsed header and payload JSON plus selected claim explanations.
- A signature verification result for supported HMAC tokens when a secret is supplied.
- A newly signed compact JWT from the encoder.
How it works
Decode Base64url
The first two token segments are Base64url-decoded and parsed as JSON.
Verify HMAC signatures
For HS256, HS384, or HS512, Web Crypto recomputes the signature over the original header and payload using the supplied secret.
Sign tokens
The encoder serializes the chosen header and payload, Base64url-encodes them, and adds a supported HMAC signature.
Practical example
- Scenario
- Troubleshooting a token created by an internal HS256 service
- Action
- Decode the token, confirm alg is HS256, then enter the secret and verify the signature.
- Input
- A three-part JWT and the service’s development shared secret
- Expected result
- The page shows the payload and whether that secret matches the signature. You must still check expiry, issuer, audience, and application policy separately.
Limitations
- Signature operations support only HS256, HS384, and HS512; RSA, ECDSA, EdDSA, JWK, and remote key sets are not supported.
- Decoding a token does not validate its signature or make its claims trustworthy.
- The tool displays exp, nbf, and iat values but does not enforce expiry, not-before, issuer, audience, nonce, or replay-prevention policy.
- HMAC verification requires the real shared secret. Do not expose a production secret on an untrusted device.
- The encoder is suitable for testing supported HMAC workflows, not for replacing server-side token issuance and key management.
Frequently Asked Questions
Does decoding verify a JWT?
No. Decoding only reveals the header and payload. Authenticity requires a successful signature check with the correct key plus appropriate claim validation.
Which algorithms can this page sign or verify?
It supports shared-secret HMAC algorithms HS256, HS384, and HS512. It does not support RSA or elliptic-curve JWT signatures.
Does a valid signature mean I should accept the token?
Not by itself. Your application must also enforce algorithm expectations and validate claims such as exp, nbf, iss, and aud according to its policy.
Is the token sent to a server?
No. The decoder and supported Web Crypto signature operations run in your browser.