← All tools

JWT Decoder & Generator

Decode, verify and generate JSON Web Tokens with readable, color-coded output.

Verify Signature

Used to verify the JWT signature. You must provide the correct secret.

Similar Tools

Hash & Encoder

MD5, SHA-256 & Base64.

Regex Tester

Test & highlight patterns.

JSON Formatter & Validator

Pretty-print, minify & validate JSON.

Built with privacy in mind. All processing happens entirely in your browser using open-source libraries.

What is the JWT Decoder & Generator?

A JSON Web Token (JWT) is a compact, signed token that carries claims between systems. This tool splits any JWT into its header, payload and signature, decodes the Base64-encoded JSON, and color-codes every part so you can read the token instantly instead of squinting at a single line of characters.

Because everything runs locally in your browser, sensitive tokens never leave your device. exp and iat timestamps are converted automatically to your local time, and the built-in generator creates HS256/HS384/HS512 tokens so you can test your integration end to end.

How to use the JWT Decoder & Generator?
  1. Paste a JWT into the input box.
  2. Click Decode Token to see the color-highlighted header, payload and signature.
  3. Switch to the Generate tab, enter a JSON payload and a secret, then click Generate Token.

Frequently Asked Questions (FAQ)

Is the JWT Decoder free?

Yes, free with no signup or limits.

Are my tokens uploaded anywhere?

No. Decoding and generation happen entirely in your browser.

Does the generator sign tokens?

Yes, it creates HS256/HS384/HS512 signatures using the Web Crypto API.

Which algorithms are supported?

Decoding works with any JWT. Signing and HMAC verification support HS256, HS384 and HS512 via the Web Crypto API.

Can I verify a signed token?

Yes. After decoding, enter the token's HMAC secret in the verify box to check the signature locally; a green tick or red cross appears instantly.

Does it check whether a token has expired?

Yes. Decoding converts exp, iat and nbf to your local time and flags expired tokens, with extra warnings for a missing alg, wrong typ or exp before nbf.