JWT Tools

Decode, edit, sign and verify JWTs locally in your browser.

Runs locally in your browser. Your input is not uploaded or saved.

Workspace

Decoding does not verify a signature. Use optional signature verification below to check a token against a shared secret.

JWT

Bearer, JWT, Token and other single-word prefixes are removed on paste.

Decoded header

Decoded payload

Optional signature verification

Expected algorithm

Shared secret (exact UTF-8 text)

HMAC algorithms only. RSA/ECDSA keys are not supported. The secret is used as text, not decoded from Base64. Signature verification does not validate issuer, audience, expiration or other claims.

Signature not verified.

Also useful

Timestamp Converter

Convert timestamps and build custom Python-style datetime formats.

Date & TimeClient-side

Base64

Encode and decode UTF-8 text with URL-safe and multi-layer Base64.

EncodingClient-side