Online Tool Store
JWT Encoder / Decoder
Decode a JWT's header and payload, or encode and sign a new HS256 token from JSON and a secret, using the Web Crypto API. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Header
Payload
How it works
- Decode: paste a token — its header and payload are split on the dots and base64url-decoded into readable JSON.
- Encode: write a JSON payload and a secret — the header and payload are base64url-encoded, then signed with HMAC-SHA256 using the Web Crypto API.
- The three signed parts (header, payload, signature) are joined with dots to form the final token.
FAQ
What algorithm does the encoder use?
HS256 (HMAC-SHA256) — the most common JWT signing algorithm for shared-secret setups, computed with the browser's native Web Crypto API.
Does decoding verify the signature?
No — decoding only reads the header and payload, which are just base64url-encoded JSON and not encrypted. Anyone can read a JWT's contents without the secret; only a valid signature proves it wasn't tampered with.
Is it safe to paste a real production secret here?
The tool never transmits anything — signing happens entirely in your browser — but as a general rule, avoid pasting production secrets into any third-party tool. Use a test secret when trying this out.
Can I decode tokens signed with RS256 or other algorithms?
Yes for reading the header/payload — decoding doesn't depend on the algorithm. Encoding here only supports HS256.
How we compare
| Feature | Online Tool Store | jwt.io | Backend script |
|---|---|---|---|
| Signing happens entirely client-side | ✓ | ✓ | ✗ (server-side) |
| No sign-up | ✓ | ✓ | ✓ |
| No code to write | ✓ | ✓ | ✗ |
If you're debugging an auth flow and need to quickly inspect or mint a test token, this skips writing a throwaway script.