- Home
- Generators & Encoders
- JWT Encoder / Decoder
JWT Encoder & Decoder
Paste a token to read its header and payload. Or fill header, payload and a secret, then sign an HS256 token. Reading a token does not prove the signature is valid. RSA keys are not accepted here.
What it is for?Decode
Encode HS256
What it is for?
Decode is not verify
A JSON Web Token (JWT) is three pieces of text joined by dots: header, payload, signature. The middle piece is only Base64. Anyone can read it without the secret. This page shows that JSON. It does not check the signature, so a forged token still “decodes”. If the header says alg=none, there is no signature at all.
Signing
Sign token builds header.payload.signature with HMAC-SHA256 in this browser. The header is forced to alg HS256. You must type a secret; an empty secret is refused. RS256 and ES256 need a private key file. This tool does not take those files.
It stays in the browser
The token and the secret are not sent to a server. They sit in this tab’s memory until you close it. Do not paste a live production secret unless you accept that.