JWT Decoder & Generator

Runs entirely in your browser

Decode a JWT's header and payload, or build and sign a new JWT with HS256, HS384 or HS512 — directly in your browser.

Advertisement

Decoding a JWT does not verify its signature. Never trust a token's claims without server-side verification.

Advertisement

What is JWT Decoder & Generator?

A JSON Web Token (JWT) is a compact, three-part token used for authentication and authorization. Decode splits a token into its Header, Payload and Signature, decodes the Header and Payload from Base64url to readable JSON, and highlights common time-based claims. Generate builds a new JWT from a header and payload you define, then signs it with HMAC (HS256, HS384 or HS512) using a secret you provide — useful for generating test tokens during development without running a backend.

How to use JWT Decoder & Generator

  1. Choose Decode or Generate & Sign above.
  2. To decode: paste a JWT and click Decode, then review the decoded header and payload.
  3. To generate: edit the Header and Payload JSON, choose an algorithm and secret, then click Generate & Sign and copy the resulting token.

Features

  • Decode: splits a JWT into Header, Payload and Signature, and decodes the Header and Payload as formatted JSON.
  • Decode: shows human-readable issued-at (iat) and expiration (exp) times when present.
  • Generate: supports HS256, HS384 and HS512 signing with a fully editable header and payload.
  • Generate: uses the Web Crypto API for signing — not a hand-rolled implementation.
  • 100% client-side — your tokens and secrets never leave your browser.

Example

Pasting this well-known sample token (the same one used on jwt.io's homepage) into Decode:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

decodes to this header:

{
  "alg": "HS256",
  "typ": "JWT"
}

and this payload:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

with "Issued at" shown as January 18, 2018 — converted from the raw iat Unix timestamp. Nothing about this process checks whether the signature is genuine.

With the default header, payload, HS256 algorithm and the placeholder secret your-256-bit-secret shown in Generate, this tool produces:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.Gfx6VO9tcxwk6xqx9yYzSfebfeakZp5JYIgP_edcw_A

Changing a single character in the header, payload or secret produces a completely different signature — that's what lets a verifier detect tampering, provided they check it.

Security notes

  • Decoding: the header and payload are decoded with atob() and then re-decoded as strict UTF-8 (with fatal: true) — a segment containing invalid UTF-8 byte sequences is rejected with an error rather than silently displayed as garbled or replacement characters.
  • Decoding: the alg field you see is taken directly from the attacker-controllable header — it is not proof of how, or whether, the token was actually signed. A well-known class of real-world JWT vulnerabilities ("alg confusion" or accepting alg: none) comes from server code that trusts this field instead of enforcing an expected algorithm.
  • Decoding: because the payload here is decoded, not verified, anyone can edit a token's exp or any other claim before pasting it in — the values shown are exactly what's inside the token, with no guarantee they reflect what a legitimate issuer actually set. If you need to confirm a token is authentic, verify it server-side (or with a trusted library) using the issuer's secret or public key — this tool intentionally does not attempt that.
  • Generating: signing goes through crypto.subtle.importKey() with an HMAC key, then crypto.subtle.sign() — the same standards-based Web Crypto API used by Hash Generator's SHA functions, not a hand-rolled HMAC. Because HMAC is symmetric, anyone holding the secret can forge a token that looks just as valid as one you generated — treat any secret you type here as compromised the moment you use it for something beyond a local test, and never reuse a real production secret in a browser tool.
  • Generating: this tool doesn't add exp or iat automatically. If the code that will consume your test token checks expiry, add those claims to the payload JSON yourself before signing.

Is JWT Decoder & Generator safe?

Yes. Decoding splits your token and decodes the header and payload with strict, fatal UTF-8 decoding entirely in your browser, and generating signs your token locally using crypto.subtle.importKey() and crypto.subtle.sign() — so tokens, claims and secrets never reach a server. Just remember decoding never verifies a signature, and HMAC secrets are symmetric, so never reuse a real production secret in a browser-based tool.

Frequently Asked Questions

Does decoding a JWT verify it?

No. Decoding a JWT does not verify its signature. Anyone can decode a JWT's header and payload — only a server holding the correct secret or public key can confirm the token is authentic and untampered.

What do exp and iat mean?

exp (expiration time) and iat (issued at) are standard JWT claims storing Unix timestamps. When present, decoding shows both as human-readable dates.

What happens if the token I paste to decode is invalid?

You'll see a clear error message. A JWT must have exactly three Base64url segments separated by dots, with valid JSON in the header and payload.

Which signing algorithms are supported for generating a token?

HS256, HS384 and HS512 — HMAC-based signing with a shared secret. RSA/EC-signed tokens (RS256, ES256, etc.) require a private key pair and aren't supported here.

Can I verify a token I generate here?

Yes — switch to Decode with the same secret and algorithm in mind. Decoding shows the header and payload, but remember it never verifies the signature.

Related tools