Developer
JWT
Decode, inspect and sign JSON Web Tokens locally.
Decoded in your browser. The signature is not verified — that needs the key.
How it works
1
Paste a token
Drop in a JWT to split it into its header, payload and signature.
2
Inspect the claims
Read the decoded header and payload, including standard claims like issuer, subject and expiry.
3
Sign or verify
Provide a secret to sign a new token or check an existing signature — all in your browser.
Why use JWT
Nothing leaves the page
Tokens often carry sensitive claims. Here they are decoded and signed locally, never sent to a server.
Human-readable claims
Timestamps like exp and iat are shown so you can see at a glance whether a token has expired.
Sign and verify
Test your auth flow by minting tokens with a secret and verifying signatures without leaving the browser.
Frequent questions
Is it safe to paste a real token here?
Yes. Everything runs in your browser — the token and any secret you enter are never uploaded. Still, treat production secrets with care on any shared machine.
Can I tell if a token has expired?
Yes. The decoded payload shows the exp claim as a readable date, so you can see whether it is still valid.
Which algorithms are supported for signing?
HMAC signing (HS256 and friends) with a shared secret, which covers the most common JWT use.
Explore more tools
JSON validator
Validate, format and minify JSON.
Regex tester
Test regular expressions live.
Base64
Encode and decode Base64.
Hash generator
Generate SHA-1/256/384/512 hashes.
File checksum verifier
Verify a file against a checksum.
UUID generator
Generate random UUIDs (v4).
Password generator
Generate strong random passwords.
URL encode / decode
Percent-encode and decode URL components.