Documentation · Playgrounds
Back to toolJWT Encoder / Inspector
Encode, decode, inspect, and verify JWT tokens in the browser. Header, payload, and signature are handled locally — the token is never sent to a server.
Everything runs on your device. Still: do not paste production tokens or real secrets into any site (including this one) unless you trust the environment.
Tabs
| Tab | What it does |
|---|---|
| Inspect | Shows header, payload, time claims, and lets you verify the signature |
| Decode | Only reads the token (Base64URL → JSON), without validating the signature |
| Encode | Creates a JWT signed with HMAC (HS256 / HS384 / HS512) |
Decode vs verify
- Decode only interprets the content. A forged or invalid token can still “open” if the Base64 is intact.
- Verify checks the signature with the key you provide. Only then can you claim the token was not tampered with.
Decoding ≠ authentication. Without signature verification, treat the payload as untrusted data.
Supported algorithms
| Use | Algorithms |
|---|---|
| Encode | HS256, HS384, HS512 (HMAC) |
| Verify | HMAC (HS*), RSA (RS*), and ECDSA (ES*) — with the matching key |
The tool does not sign with RSA/ECDSA (it only verifies with a public key). Tokens with alg: none are not treated as a valid signature.
How to use (summary)
- Paste the token in Inspect or Decode.
- To verify: provide an HMAC secret or a public key (PEM / JWK, depending on format).
- In Encode, build header/payload and an HMAC secret to create a test token.
Technology used
- @noble/hashes for HMAC (SHA-256 / 384 / 512) in the browser.
- Web Crypto API for RSA and ECDSA verification.
- Base64URL encoding with no server involved.