JWT Decoder & Encoder

A JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It consists of three parts: header, payload, and signature. JWTs are commonly used for authentication and authorization in web applications.

Yes, absolutely! All JWT decoding and encoding happens entirely in your browser using JavaScript. No data is sent to our servers. Your tokens and secrets remain completely private. However, as a best practice, avoid using production tokens or real secrets on any online tool.

Our tool supports 9 JWT algorithms: HS256, HS384, HS512 (HMAC with SHA), RS256, RS384, RS512 (RSA with SHA), and ES256, ES384, ES512 (ECDSA with SHA). HMAC algorithms use symmetric keys, while RSA and ECDSA use asymmetric key pairs.

To verify a JWT signature: 1) Paste your token in the decoder, 2) Enter your secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms), 3) Click "Verify Signature". The tool will indicate whether the signature is valid. A valid signature means the token hasn't been tampered with.

JWT claims are statements about an entity. Common registered claims include: exp (expiration time) - when the token expires, iat (issued at) - when the token was created, nbf (not before) - the time before which the token should not be accepted. Our tool automatically validates these claims and shows a countdown timer for expiration.

While all processing happens locally in your browser, we recommend using this tool only for development and debugging purposes. For production environments, use official JWT libraries in your programming language. Never paste production secrets or sensitive tokens into any online tool as a security best practice.

HS256 uses HMAC with SHA-256 and requires a shared secret key for both signing and verification (symmetric). RS256 uses RSA with SHA-256 and uses a private key for signing and a public key for verification (asymmetric). RS256 is generally preferred for production as it allows public verification without exposing the signing key.

In the Encoder tab, you can add custom claims by editing the payload JSON. Simply add your custom fields to the JSON object. For example: {"sub": "1234", "name": "John", "role": "admin", "customField": "value"}. Custom claims can be any valid JSON data type (string, number, boolean, array, object).

A JWT can be invalid for several reasons: 1) Incorrect format (must have 3 parts separated by dots), 2) Invalid Base64URL encoding, 3) Malformed JSON in header or payload, 4) Signature verification failed (wrong secret/key), 5) Token expired (exp claim in the past), 6) Token not yet valid (nbf claim in the future). Check the error message for specific details.

Yes! You can decode and view the header and payload of any JWT without the secret key. JWTs are Base64URL encoded, not encrypted, so the data is readable by anyone. However, you need the secret key to verify the signature and confirm that the token hasn't been tampered with. Remember: JWTs provide integrity (through signatures), not confidentiality.