JWT encoder / decoder
Decode JWT headers and payloads, inspect common claims, and create signed or unsigned tokens with custom header, payload, and secret input.
About this tool
Decode any JWT to inspect its header, payload, and claims — or encode signed/unsigned tokens. Runs entirely in your browser, no token ever uploaded.
Decode JWT headers and payloads, inspect common claims, and create signed or unsigned tokens with custom header, payload, and secret input.
- 1
Paste a JWT token (the three-part dot-separated string) into the input field.
- 2
The tool instantly decodes and displays the header, payload, and signature in separate panels.
- 3
Check the payload for claims like exp (expiry), sub (subject), and iss (issuer).
- 4
Note: this tool decodes — it does not verify the signature. Never trust a JWT without server-side verification.
Inspect copied bearer tokens from API requests, logs, or auth middleware.
Decode header and payload claims without sending the token to a server.
Review issued-at and expiry claims when debugging session problems.
Decode a JWT header
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9{"alg":"HS256","typ":"JWT"}Decode a JWT payload
eyJzdWIiOiJ1c2VyXzEyMyIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDM2MDAwfQ{"sub":"user_123","iat":1700000000,"exp":1700036000}These answers explain common jwt encode/decode tasks, expected input formats, and edge cases so both visitors and search engines can understand what this tool does.
Does this JWT inspector verify the token signature?
No. This tool decodes the token header and payload for inspection. It does not validate the signature or confirm that the token was issued by a trusted source.
Can this tool create a signed JWT?
Yes. The encoder can generate JWTs using HMAC algorithms such as HS256, HS384, and HS512 when you provide a secret. It can also create unsigned tokens when the header alg is set to none.
What parts of a JWT does this tool show?
It shows the decoded header and payload, plus common summary fields such as algorithm, issuer, subject, audience, and time-based claims when they are present.
Can I inspect expired JWTs?
Yes. Even an expired token can still be decoded and inspected. The decoded payload helps you review the exp, iat, and nbf claims when debugging auth issues.
Should I paste production secrets into a JWT tool?
Only if you trust the tool and your environment. This app runs in the browser, but sensitive tokens should still be handled carefully and only when necessary.
The jsonwebtoken package is the standard Node.js JWT library. Use jwt.sign to create tokens and jwt.verify to validate them.
// npm install jsonwebtoken
const jwt = require("jsonwebtoken");
const secret = "my-secret-key";
const payload = { userId: 42, name: "Alice", role: "admin" };
// Sign (encode) — HS256 is the default algorithm
const token = jwt.sign(payload, secret, { expiresIn: "1h" });
console.log(token);
// eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
// Verify and decode
try {
const decoded = jwt.verify(token, secret);
console.log(decoded);
// { userId: 42, name: 'Alice', role: 'admin', iat: ..., exp: ... }
} catch (err) {
if (err.name === "TokenExpiredError") console.error("Token expired");
else console.error("Invalid token:", err.message);
}
// Decode without verifying (inspect header/payload only)
const unverified = jwt.decode(token, { complete: true });
console.log(unverified.header); // { alg: 'HS256', typ: 'JWT' }
console.log(unverified.payload);