JWT Encode / Decode

Easily encode or decode JSON Web Tokens. Paste your token to view its Header and Payload, or provide JSON payloads and a secret key to generate a signed HS256 token.

Enter JWT

What is this tool?

The JWT Encode & Decode Utility is a robust tool designed for developers to inspect, verify, and generate JSON Web Tokens (JWTs). JWTs are a compact, URL-safe means of representing claims to be transferred between two parties, widely used across modern web applications for stateless authentication.

This tool provides two core functionalities: Decoding allows you to paste an existing JWT and instantly parse its Header (which contains metadata and algorithms) and its Payload (which contains user claims and expiration data). Encoding allows you to write custom JSON payloads, supply a secret key, and generate a fully valid, cryptographically signed token using the HS256 algorithm. All operations happen strictly on your device for absolute privacy.

How to Use

  1. 1

    Select your action

    Choose either the 'Decode JWT' or 'Encode JWT (HS256)' tab depending on what you need.

  2. 2

    Provide input

    For decoding, paste your full token. For encoding, provide the JSON Header, JSON Payload, and your Secret Key.

  3. 3

    Execute

    Click the 'Decode Token' or 'Encode Token' button. The page will process your input and present the parsed JSON or the newly generated token.

The Science & Logic Behind It

A JSON Web Token physically consists of three distinct parts separated by dots (.): the Header, the Payload, and the Signature. It looks like this: xxxxx.yyyyy.zzzzz

  • Header: Typically consists of two parts: the type of the token (JWT) and the signing algorithm being used, such as HMAC SHA256 or RSA.
  • Payload: Contains the claims. Claims are statements about an entity (typically, the user) and additional data. There are registered claims (like iss for issuer and exp for expiration time), public claims, and private claims.
  • Signature: To create the signature part, you have to take the encoded header, the encoded payload, a secret, and the algorithm specified in the header to sign it.

It is critical to understand that the Header and Payload of a standard JWT are merely Base64Url encoded. They are not encrypted. Anyone who intercepts a JWT can easily decode and read the contents of the payload. The security of a JWT relies entirely on the Signature, which ensures the payload has not been tampered with.

Practical Use Cases

  • Debugging Authentication: When building login systems (like OAuth 2.0 or OpenID Connect), developers use this tool to quickly verify if the backend is attaching the correct user roles and expiration times to the token.
  • Testing API Endpoints: QA engineers often need to generate fresh, signed JWTs with specific claims (like simulating an admin user vs a standard user) to test how protected API routes respond to different authorization levels.
  • Verifying Token Expiration: By decoding a token, you can read the exp (expiration) claim, which is a UNIX timestamp, to figure out exactly when a session is programmed to expire.

Frequently Asked Questions