What it does
Encode and decode JSON Web Tokens (JWT) entirely in the browser. Paste an existing JWT to decode its header, payload, and verify its signature against a shared secret. Or generate a new signed JWT by providing a payload and a secret key. No data is ever sent to any server — cryptographic operations run via the Web Crypto API.
Try it
How it works
Decode / Verify
- Paste a JWT into the input field.
- Optionally enter the shared secret used to sign it.
- Click Decode & Verify to split the token into its three parts (header, payload, signature) and validate the signature if a secret is provided.
The tool splits on . and decodes the Base64URL-encoded header and payload. If a secret is given, it recomputes the HMAC signature and compares it byte-for-byte with the provided value.
Encode / Sign
- Enter a JSON payload (or use the pre-filled example).
- Set the shared secret key.
- Choose the algorithm (HS256, HS384, or HS512).
- Click Sign & Encode to build a new JWT.
The tool Base64URL-encodes the header and payload, then uses the Web Crypto API (crypto.subtle) to compute an HMAC signature, and concatenates the three Base64URL strings with . separators.
Claims reference
| Claim | Meaning |
|---|---|
iss | Issuer — who created the token |
sub | Subject — who the token is about |
aud | Audience — who the token is intended for |
exp | Expiration time (Unix timestamp) |
iat | Issued at (Unix timestamp) |
nbf | Not before (Unix timestamp) |
Security note
This tool uses HMAC algorithms (HS256/HS384/HS512). For production systems you should prefer asymmetric algorithms (RS256, ES256) where the public key can be shared freely without revealing the private key. HMAC shared secrets must be kept confidential on both sides.