JSON Web Token Toolkit
Decode, verify and generate JWTs. Everything runs locally in your browser — no token ever leaves this page.
Encoded
Your token will appear here…
Verify signature
Algorithm*
Nothing to decode yet
Paste a token on the left, or load an example to see the header, payload and signature.
Frequently asked questions
- What is a JSON Web Token (JWT)?
- A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three base64url-encoded parts separated by dots — a header, a payload, and a signature — and is commonly used for authentication and authorization as a bearer token.
- Is it safe to paste my token here?
- Yes. Every operation — decoding, verifying and signing — runs entirely in your browser using the Web Crypto API. Your token, secrets and keys are never sent to any server, logged or stored.
- How do I verify a JWT signature?
- Open the Decoder, paste your token, then choose a verification method: a shared secret for HMAC algorithms (HS256/384/512), a public key in PEM form for RSA/EC/PS algorithms, or an OpenID issuer URL to fetch the provider's JWKS and match the token's key ID automatically.
- Can I create and sign a new JWT?
- Yes. The Encoder lets you edit the header and payload as JSON, pick an algorithm, and provide a secret or private key to produce a signed token you can copy or open straight back in the Decoder.
- Does decoding a JWT reveal the signature's validity?
- No. Decoding only base64url-decodes the header and payload — anyone can read those. The signature proves the token hasn't been tampered with, and can only be trusted once you verify it against the correct key.