JWT Encoder and Decoder
Create and inspect signed JSON Web Tokens directly in your browser. Paste a payload, sign with an HS256 secret, and receive a complete token, or decode one back into its parts.
Using the JWT Encoder & Decoder: step by step
- Enter your payload claims and header settings in the editor.
- Provide the HS256 shared secret for signing.
- Press encode to produce the signed, three-part token.
- Switch to decode mode to inspect any token's header and payload.
What people use the JWT Encoder & Decoder for
- Generating test tokens for local development without a full auth server.
- Reproducing an authentication bug with a known, controlled payload.
- Checking how claim changes affect the resulting token signature.
- Teaching how JWT signing and verification actually work.
Inside the JWT Encoder & Decoder
The encoder builds the token the standard way: Base64URL-encode the header and payload, then sign the two joined segments with HMAC-SHA-256 using your secret via the browser's Web Crypto API. Signing happens locally, so neither your secret nor the resulting token is transmitted, which is essential because HS256 secrets grant token-minting power.
Limitations worth knowing
Tokens minted here are for testing; production systems should use proper key management, rotation, and preferably asymmetric signing like RS256.
JWT Encoder & Decoder FAQ
Which signing algorithms are supported?
HS256 symmetric signing, the most common choice for shared-secret setups.
Does the tool keep my secret?
No. The secret exists only in your browser tab and is discarded on close.
Can I verify an existing token's signature?
Decode mode reveals contents; with the same secret you can re-sign and compare signatures for verification.
Last reviewed: October 2026.