JWT Encoder / Decoder
Acerca de JWT Encoder / Decoder
Our free online JWT Encoder / Decoder decodes any JSON Web Token to reveal its header and payload, and can verify HS256 (HMAC-SHA256) signatures when you provide the signing secret. It can also encode a brand-new signed token from your own header/payload JSON.
Everything happens locally in your browser - your tokens and secrets are never transmitted anywhere, though as a general precaution avoid pasting real production secrets into any online tool.
How to Use the JWT Encoder / Decoder
- Paste an existing JWT into the decode box to instantly view its decoded header and payload
- If the token uses HS256, enter the signing secret to verify the signature is valid
- To create a new token, switch to encode mode and enter your header and payload as JSON
- Enter a secret and generate an HS256-signed token
- Copy the resulting token for use in testing or debugging
Note that signature verification here only supports the HS256 (HMAC-SHA256) algorithm; tokens signed with RS256 or other asymmetric algorithms can still be decoded to inspect their header and payload, but their signatures cannot be verified with this tool.
- Decodes any JWT to inspect its header and payload
- Verifies HS256-signed tokens when given the correct secret
- Encodes new HS256-signed tokens from custom JSON
- Runs entirely in your browser - tokens and secrets are never transmitted
- Includes unlimited use with a RankWise Tools membership
Related Tools
Frequently asked questions
Is it safe to paste a real production JWT here?
Decoding happens entirely in your browser (nothing is sent anywhere), but as a general rule avoid pasting tokens containing real production secrets or sensitive user data into any online tool - use a test/example token when possible.
Which signing algorithms are supported?
Encoding and signature verification support HS256 (HMAC-SHA256), the most common JWT signing method. Tokens signed with RS256/ES256 (asymmetric, public/private key) can still be decoded to view the header and payload, but their signature can't be verified without the correct public key.
Why does my token show "signature invalid"?
Either the secret you entered doesn't match the one used to sign the token, or the token was signed with an asymmetric algorithm (RS256/ES256) that can't be verified with a plain secret string.
