Skip to content
DevToolKits.app
Token helper

JWT Tool

Enter a header and payload in JSON format to generate, copy, decode, and verify HS256-signed JWTs directly in your browser.
Generated tokens are displayed instantly and can be copied with a single click.

Guide: How to use & features

  • Paste a JWT to automatically decode its header and payload.
  • Enter the shared secret and click “Verify” to check the signature.
  • To issue a new token, edit the payload, set a secret, and click “Sign.”
  • All operations run locally, so secrets never leave your browser.

Samples: Sample input & output

Decode a JWT

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGV2a2l0cyIsImV4cCI6MTcwNjY0MDAwMH0.v9kpsYy6oF9E9e_t1z23v8GpU0mHP5uP6fMIv1wBtRM

Output

{
  "user": "devkits",
  "exp": 1706640000
}

FAQ: FAQ

  • What is the difference between decoding and verifying the signature?

    Decoding simply expands the Base64URL header and payload to show their contents without a secret — it does not prove the token is genuine. Enter the secret to verify the HS256 signature and confirm the token was not tampered with. Never trust the contents of a token you have not verified.

  • Why can anyone read the payload? Is it safe to put secrets in it?

    A JWT payload is Base64URL-encoded, not encrypted, so anyone can decode and read it even when it is signed. The signature provides tamper detection, not confidentiality. Do not place passwords or personal data in the payload.

  • Is it safe to paste a production token here?

    Everything runs in your browser and no token or secret is sent anywhere. That said, a valid production token grants access on its own, so avoid pasting one on a shared machine and prefer test tokens when you can.

Use cases: Common use cases

  • Inspecting claims

    Decode JWT headers and payloads to confirm exp, aud, and other claims on the spot.

  • Gathering clues for bugs

    Paste problematic tokens to see their values and decide whether the issuer or verifier is at fault.

  • Adjusting tokens for tests

    Edit claims and re-encode to craft tokens with different expirations or scopes for test cases.

Notes: Notes & limitations

  • Work stays in your browser

    Inputs and outputs remain local. Closing the tab or clearing cache will remove any temporary state.

  • Validate critical data

    Results are helper outputs—double-check them before sending to production systems or sharing externally.

  • Large payloads depend on your device

    Very large text or files can feel slow in some browsers. Use a desktop environment for heavy workloads.

All processing happens entirely in your browser; nothing is sent anywhere.

Decode a JWT

Enter the secret to verify the signature
Header 
 
 
 Payload 
 
 
 
 
 
 
  
 
 
JWT Decoder and Verification Tool


JWTs are commonly used for authentication, session handling, and API authorization. This tool decodes the header and payload of a JSON Web Token in your browser so you can inspect claims such as sub, iss, aud, iat, and exp. It also helps you check token structure and review signature-related data during debugging.


When it helps


    

  • Debug login issues: Confirm whether a token contains the expected user ID, issuer, audience, and expiration time.
    • 

  • Inspect API authorization: Review token claims before sending requests to protected endpoints.
    • 

  • Check token lifetime: Convert iat and exp values into human-readable times and spot expired tokens.
    • 



Security note


JWT payloads are encoded, not encrypted. Anyone with the token can read the header and payload. Avoid pasting production tokens into tools you do not trust, and never share tokens that contain session or authorization data.
 
 
Articles for this tool
Introduction
2026-02-16
JWT Security Deep Dive: Attack Vectors, JWKS, and Production Best Practices
A thorough guide to JWT security — covering the alg:none attack, algorithm confusion, key management with JWKS, token revocation strategies, and a production-ready security checklist.
Introduction
2026-01-11
Understanding JWT (JSON Web Token): Structure, Claims, and Secure Debugging
A comprehensive guide to JWT — how the Header, Payload, and Signature work, which claims matter most, common security pitfalls, and how to safely decode tokens in your browser.
Introduction
2026-01-11
What is JWKS (JSON Web Key Set)?
How JWKS works, what each field in the JSON means, how it's used during JWT signature verification, and what to watch for during key rotation. Generate an RSA key pair and see both JWKS and PEM formats in your browser.
Recent Articles
Introduction
2026-08-03
How CREATE TABLE Generation From a Visual Table Design Works | DDL Builder
A look inside DDL Builder, which turns a visually designed table into CREATE TABLE statements and an ER diagram. Covers the MySQL/PostgreSQL/SQLite type-mapping rules and the column-inference algorithm used for JSON samples.
Use Case
2026-07-21
GitHub Actions needs Design Patterns: Speed Up CI, Avoid the Anti-Patterns
A pattern reference for GitHub Actions job dependencies (needs). Covers diamond-shaped fan-out, concurrency cancellation, fail-fast tradeoffs, matrix-plus-needs gotchas, and reusable workflows, with copy-paste YAML examples.
Use Case
2026-07-21
SQL JOIN Types: Complete Reference to INNER, LEFT, RIGHT & FULL
A reference for SQL JOIN types (INNER/LEFT/RIGHT/FULL/CROSS/SELF) with a cheat sheet and row-count walkthroughs. Covers why one-to-many joins duplicate rows, the WHERE-vs-ON NULL trap, and how to write multi-table joins.
Introduction
2026-07-16
Case Converter: camelCase, snake_case & kebab-case — 9 Styles at Once
Convert identifiers between camelCase, PascalCase, snake_case, CONSTANT_CASE, kebab-case and more — all nine styles side by side. Handles acronym runs like HTTPServer, digits, and bulk multi-line conversion.
Introduction
2026-07-16
LLM API Cost Calculator: Compare Claude, GPT & Gemini Pricing Side by Side
Paste a prompt, set the expected output tokens, and compare per-request API costs across Claude, GPT and Gemini models. Covers input/output pricing structure, auto-updated price tables, and estimate limits.
Use Case
2026-07-14
AGENTS.md, CLAUDE.md, Cursor Rules: One Source of Truth for AI Coding Agents
Every AI coding agent wants its own rules file. Compare AGENTS.md, CLAUDE.md, .cursor/rules, copilot-instructions.md and more — what to write, a copy-paste template, and how to stop them drifting apart.
  
 
 
 
 
Ad
  
 
 
 
 
 
 
  
 Stay within DevToolKits with shortcuts to the most-used utilities across the site. 
 
  
 
 
  
      Articles 
  1   
    Article Index      
 
  
      AI & LLM 
  3   
    AI Rules Generator        LLM Token Counter        LLM API Cost Calculator      
 
  
      Development & DevOps 
  9   
    GitHub Actions Visualizer        SQL Formatter        Visual SQL Builder        DDL Builder        SQL → ER Diagram        cURL Converter        chmod Calculator        Cron Editor & Parser        Infrastructure Diagram Builder      
 
  
      Data Conversion & Schemas 
  6   
    JSON Formatter        JSON → TypeScript        JSON → Zod        JSON → OpenAPI        JSON ⇔ YAML        CSV ⇔ JSON Converter      
 
  
      Security & Cryptography 
  5   
    Base64 / 58 / 32        JWT Tool        Hash & HMAC Generator        JWKS Generator        UUID Generator      
 
  
      Text & Code Helpers 
  5   
    Markdown Table Generator        Text & Code Suite        Regex Tester        Diff Viewer        Case Converter      
 
  
      URL, QR & Network 
  5   
    URL Encode / Decode        IP / CIDR Calculator        URL Params → JSON        QR Generator        QR Reader      
 
  
      Design & UI 
  2   
    Color Utility        Favicon Generator      
 
  
      Date & Time 
  3   
    Time Zone Converter        Time Units        UNIX Timestamp Converter      
 
 
 
 
 
 
 
 
 
Ad