Skip to content
DevToolKits.app
Token helper

JWT Tool

Enter a header and payload in JSON format to generate, copy, decode, and verify HS256-signed JWTs directly in your browser.
Generated tokens are displayed instantly and can be copied with a single click.

Guide: How to use & features

  • Paste a JWT to automatically decode its header and payload.
  • Enter the shared secret and click “Verify” to check the signature.
  • To issue a new token, edit the payload, set a secret, and click “Sign.”
  • All operations run locally, so secrets never leave your browser.

Samples: Sample input & output

Decode a JWT

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGV2a2l0cyIsImV4cCI6MTcwNjY0MDAwMH0.v9kpsYy6oF9E9e_t1z23v8GpU0mHP5uP6fMIv1wBtRM

Output

{
  "user": "devkits",
  "exp": 1706640000
}

FAQ: FAQ

  • What is the difference between decoding and verifying the signature?

    Decoding simply expands the Base64URL header and payload to show their contents without a secret — it does not prove the token is genuine. Enter the secret to verify the HS256 signature and confirm the token was not tampered with. Never trust the contents of a token you have not verified.

  • Why can anyone read the payload? Is it safe to put secrets in it?

    A JWT payload is Base64URL-encoded, not encrypted, so anyone can decode and read it even when it is signed. The signature provides tamper detection, not confidentiality. Do not place passwords or personal data in the payload.

  • Is it safe to paste a production token here?

    Everything runs in your browser and no token or secret is sent anywhere. That said, a valid production token grants access on its own, so avoid pasting one on a shared machine and prefer test tokens when you can.

Use cases: Common use cases

  • Inspecting claims

    Decode JWT headers and payloads to confirm exp, aud, and other claims on the spot.

  • Gathering clues for bugs

    Paste problematic tokens to see their values and decide whether the issuer or verifier is at fault.

  • Adjusting tokens for tests

    Edit claims and re-encode to craft tokens with different expirations or scopes for test cases.

Notes: Notes & limitations

  • Work stays in your browser

    Inputs and outputs remain local. Closing the tab or clearing cache will remove any temporary state.

  • Validate critical data

    Results are helper outputs—double-check them before sending to production systems or sharing externally.

  • Large payloads depend on your device

    Very large text or files can feel slow in some browsers. Use a desktop environment for heavy workloads.

All processing happens entirely in your browser; nothing is sent anywhere.

Decode a JWT

Enter the secret to verify the signature
Header 
 
 
 Payload 
 
 
 
 
 
 
  
 
 
JWT Decoder and Verification Tool


JWTs are commonly used for authentication, session handling, and API authorization. This tool decodes the header and payload of a JSON Web Token in your browser so you can inspect claims such as sub, iss, aud, iat, and exp. It also helps you check token structure and review signature-related data during debugging.


When it helps


    

  • Debug login issues: Confirm whether a token contains the expected user ID, issuer, audience, and expiration time.
    • 

  • Inspect API authorization: Review token claims before sending requests to protected endpoints.
    • 

  • Check token lifetime: Convert iat and exp values into human-readable times and spot expired tokens.
    • 



Security note


JWT payloads are encoded, not encrypted. Anyone with the token can read the header and payload. Avoid pasting production tokens into tools you do not trust, and never share tokens that contain session or authorization data.
 
 
Articles for this tool
Introduction
2026-02-16
JWT Security Deep Dive: Attack Vectors, JWKS, and Production Best Practices
A thorough guide to JWT security — covering the alg:none attack, algorithm confusion, key management with JWKS, token revocation strategies, and a production-ready security checklist.
Introduction
2026-01-11
Understanding JWT (JSON Web Token): Structure, Claims, and Secure Debugging
A comprehensive guide to JWT — how the Header, Payload, and Signature work, which claims matter most, common security pitfalls, and how to safely decode tokens in your browser.
Introduction
2026-01-11
What is JWKS (JSON Web Key Set)?
How JWKS works, what each field in the JSON means, how it's used during JWT signature verification, and what to watch for during key rotation. Generate an RSA key pair and see both JWKS and PEM formats in your browser.
Use Case
2026-06-19
Encoding vs Hashing vs Encryption: The Difference and When to Use Each
Base64 encoding, SHA-256 hashing and encryption are constantly confused, yet serve completely different purposes. A comparison table, concrete examples, and the right choice for each use case.
Recent Articles
Use Case
2026-08-07
curl Options Cheat Sheet: What -X, -H and -d Actually Do
A reference for the curl options you meet in real API work: why -d already implies POST, how -d differs from --data-raw, the @ prefix that silently reads a file, single vs double quotes, and why -k and -L deserve more caution than they usually get.
Introduction
2026-08-06
Converting Between JSON Schema and Zod: How required Maps to .optional()
Inside a two-way converter that turns JSON Schema into a Zod schema and Zod code back into JSON Schema. Covers the inverted defaults between required and .optional(), the constraint mapping table, and how the Zod side is parsed without executing any code.
Use Case
2026-08-06
SQL Clause Order Reference: Why WHERE Can't See Your SELECT Alias
The order you write SQL clauses is not the order the database runs them. A reference for the logical execution order (FROM → WHERE → GROUP BY → HAVING → SELECT → ORDER BY → LIMIT), why aliases fail in WHERE, when to use WHERE vs HAVING, and the MySQL/PostgreSQL differences that bite.
Use Case
2026-08-06
Unified Diff Format Reference: Reading @@ Hunks in git diff Output
How to read the unified diff format git produces: what the four numbers in @@ -12,7 +12,9 @@ mean, why a one-character edit shows as a whole-line replacement, the whitespace and line-ending traps, \ No newline at end of file, combined @@@ diffs on merges, and rename detection via similarity index.
Use Case
2026-08-06
UTC to JST Reference: The 9-Hour Offset, Cheat Sheet & Timezone Pitfalls
Convert between UTC and JST (Japan Standard Time) with a cheat sheet. Covers what Z and +09:00 mean in ISO 8601, when JavaScript date parsing silently shifts by 9 hours, MySQL/PostgreSQL timezone behavior, and why GitHub Actions cron always runs in UTC.
Use Case
2026-08-04
CREATE TABLE Reference: MySQL vs PostgreSQL vs SQLite Types & Constraints
A cross-database CREATE TABLE (DDL) reference with cheat sheets for data types, auto-increment keys (AUTO_INCREMENT / IDENTITY / rowid), foreign key ON DELETE behavior, and the CHECK constraint that MySQL silently ignores.
  
 
 
 
 
Ad
  
 
 
 
 
 
 
  
 Stay within DevToolKits with shortcuts to the most-used utilities across the site. 
 
  
 
 
  
      Articles 
  1   
    Article Index      
 
  
      AI & LLM 
  3   
    AI Rules Generator        LLM Token Counter        LLM API Cost Calculator      
 
  
      Development & DevOps 
  9   
    GitHub Actions Visualizer        SQL Formatter        Visual SQL Builder        DDL Builder        SQL → ER Diagram        cURL Converter        chmod Calculator        Cron Editor & Parser        Infrastructure Diagram Builder      
 
  
      Data Conversion & Schemas 
  6   
    JSON Formatter        JSON → TypeScript        JSON → Zod        JSON → OpenAPI        JSON ⇔ YAML        CSV ⇔ JSON Converter      
 
  
      Security & Cryptography 
  5   
    Base64 / 58 / 32        JWT Tool        Hash & HMAC Generator        JWKS Generator        UUID Generator      
 
  
      Text & Code Helpers 
  5   
    Markdown Table Generator        Text & Code Suite        Regex Tester        Diff Viewer        Case Converter      
 
  
      URL, QR & Network 
  5   
    URL Encode / Decode        IP / CIDR Calculator        URL Params → JSON        QR Generator        QR Reader      
 
  
      Design & UI 
  2   
    Color Utility        Favicon Generator      
 
  
      Date & Time 
  3   
    Time Zone Converter        Time Units        UNIX Timestamp Converter      
 
 
 
 
 
 
 
 
 
Ad