Skip to content
DevToolKits.app
Token helper

JWT Tool

Enter a header and payload in JSON format to generate, copy, decode, and verify HS256-signed JWTs directly in your browser.
Generated tokens are displayed instantly and can be copied with a single click.

Guide: How to use & features

  • Paste a JWT to automatically decode its header and payload.
  • Enter the shared secret and click “Verify” to check the signature.
  • To issue a new token, edit the payload, set a secret, and click “Sign.”
  • All operations run locally, so secrets never leave your browser.

Samples: Sample input & output

Decode a JWT

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGV2a2l0cyIsImV4cCI6MTcwNjY0MDAwMH0.v9kpsYy6oF9E9e_t1z23v8GpU0mHP5uP6fMIv1wBtRM

Output

{
  "user": "devkits",
  "exp": 1706640000
}

FAQ: FAQ

  • What is the difference between decoding and verifying the signature?

    Decoding simply expands the Base64URL header and payload to show their contents without a secret — it does not prove the token is genuine. Enter the secret to verify the HS256 signature and confirm the token was not tampered with. Never trust the contents of a token you have not verified.

  • Why can anyone read the payload? Is it safe to put secrets in it?

    A JWT payload is Base64URL-encoded, not encrypted, so anyone can decode and read it even when it is signed. The signature provides tamper detection, not confidentiality. Do not place passwords or personal data in the payload.

  • Is it safe to paste a production token here?

    Everything runs in your browser and no token or secret is sent anywhere. That said, a valid production token grants access on its own, so avoid pasting one on a shared machine and prefer test tokens when you can.

Use cases: Common use cases

  • Inspecting claims

    Decode JWT headers and payloads to confirm exp, aud, and other claims on the spot.

  • Gathering clues for bugs

    Paste problematic tokens to see their values and decide whether the issuer or verifier is at fault.

  • Adjusting tokens for tests

    Edit claims and re-encode to craft tokens with different expirations or scopes for test cases.

Notes: Notes & limitations

  • Work stays in your browser

    Inputs and outputs remain local. Closing the tab or clearing cache will remove any temporary state.

  • Validate critical data

    Results are helper outputs—double-check them before sending to production systems or sharing externally.

  • Large payloads depend on your device

    Very large text or files can feel slow in some browsers. Use a desktop environment for heavy workloads.

All processing happens entirely in your browser; nothing is sent anywhere.

Decode a JWT

Enter the secret to verify the signature
Header 
 
 
 Payload 
 
 
 
 
 
 
  
 
 
JWT Decoder and Verification Tool


JWTs are commonly used for authentication, session handling, and API authorization. This tool decodes the header and payload of a JSON Web Token in your browser so you can inspect claims such as sub, iss, aud, iat, and exp. It also helps you check token structure and review signature-related data during debugging.


When it helps


    

  • Debug login issues: Confirm whether a token contains the expected user ID, issuer, audience, and expiration time.
    • 

  • Inspect API authorization: Review token claims before sending requests to protected endpoints.
    • 

  • Check token lifetime: Convert iat and exp values into human-readable times and spot expired tokens.
    • 



Security note


JWT payloads are encoded, not encrypted. Anyone with the token can read the header and payload. Avoid pasting production tokens into tools you do not trust, and never share tokens that contain session or authorization data.
 
 
  
 
 
  
 
 
 
 
 
  
 Stay within DevToolKits with shortcuts to the most-used utilities across the site. 
 
  
 
 
  
      Articles 
  1   
    Article Index      
 
  
      AI & LLM 
  3   
    AI Rules Generator        LLM Token Counter        LLM API Cost Calculator      
 
  
      Development & DevOps 
  8   
    GitHub Actions Visualizer        SQL Formatter        Visual SQL Builder        SQL → ER Diagram        Curl Converter        Chmod Calculator        Cron Editor & Parser        Infrastructure Diagram Builder      
 
  
      Data Conversion & Schemas 
  6   
    JSON Formatter        JSON → TypeScript        JSON → Zod        JSON → OpenAPI        JSON ⇔ YAML        CSV ⇔ JSON Converter      
 
  
      Security & Cryptography 
  5   
    Base64 / 58 / 32        JWT Tool        Hash & HMAC Generator        JWKS Generator        UUID Generator      
 
  
      Text & Code Helpers 
  5   
    Markdown Table Generator        Text & Code Suite        Regex Tester        Diff Viewer        Case Converter      
 
  
      URL, QR & Network 
  5   
    URL Encode / Decode        IP / CIDR Calculator        URL Params → JSON        QR Generator        QR Reader      
 
  
      Design & UI 
  2   
    Color Utility        Favicon Generator      
 
  
      Date & Time 
  3   
    Time Zone Converter        Time Units        UNIX Timestamp Converter