JWT Tools

1. Paste a token into the JWT field. A Bearer prefix or a full Authorization header is removed when you paste.
2. Read the decoded header and payload as formatted JSON. The exp, iat and nbf claims are shown as UTC and local dates, with a note on whether the token has expired.
3. To check the signature, open Optional signature verification, choose the expected algorithm, enter the shared secret and press Verify signature.
4. To change claims, press Edit decoded token, edit the header or payload in Encode / sign, and sign it again with a secret.

A JWT has three Base64url parts separated by dots: a header, a payload and a signature. Anyone can decode the first two, because they are only encoded, not encrypted. Decoding shows what a token claims; it does not prove that the token is genuine or unmodified.

Verification recomputes the signature from the header, the payload and the secret, then compares it with the token's signature. This tool verifies HMAC tokens signed with HS256, HS384 or HS512. RS256, ES256 and other public-key algorithms are not supported, and encrypted JWE tokens cannot be decoded.

The alg value in the token header must match the algorithm you select, so a token cannot switch itself to a weaker algorithm or to none. A valid signature only confirms that the token was signed with that secret: your application still needs to check the issuer, audience, expiration and other claims.

Encode / sign builds a token from a JSON header and payload as you type. Choose Unsigned · alg: none for a token with an empty signature, Preserve / supply signature to keep an existing signature, or Sign with shared secret to sign it with HMAC. Editing the header or payload invalidates a preserved signature, and the tool does not recompute it.

The secret is used as exact UTF-8 text and is never decoded from Base64. If your server decodes a Base64 key before signing, signatures from this tool will not match.

JWT dates are NumericDate values: seconds since 1970-01-01 UTC, not milliseconds. The tool converts exp (expires), iat (issued at) and nbf (not before) to readable dates and compares exp with your device clock every second. A value that is not a number is flagged as an invalid claim.

Tokens and secrets stay in your browser: signing and verification use the built-in Web Crypto API, and the tool uploads and saves nothing. The secret is kept in this page's memory only, and Clear all, including secret removes it. Even so, treat production tokens like passwords and use test tokens when you can.

Like the rest of the site, this page uses Google Analytics and Yandex Metrica, including Metrica session replay. Tool events report only that the tool was opened or used.

The tool area is marked so that Metrica masks what you type and the results in its session recordings.