Decode JWT headers and claims, verify HMAC signatures, inspect expiration and not-before times, or generate HS256/384/512 tokens. Processing stays in your browser.
Decode JWT
Paste a compact JWT. Decoding reveals its contents but does not prove the signature is valid.
Header
JOSE header decoded from the first segment.
Payload
JWT claims decoded from the second segment.
Signature Segment
The third JWT segment, shown as Base64URL plus its decoded byte length.
—
Registered Claims
Common JWT claims are summarized here. Time claims use Unix seconds.
Verify HMAC Signature
The algorithm is read from the token header. Only HS256, HS384, and HS512 are accepted here.
The secret is never stored by this tool.
Choose how the secret input should be converted to raw HMAC key bytes.
Applied to exp and nbf claim checks only.
—
—
Signature verification and claim validity are separate. An expired token can still have a mathematically valid signature. This tool reports those results independently.
Encode JWT
Edit the header and claims, choose an HMAC algorithm, then generate a compact JWT.
Encode Header
The selected algorithm below overrides the alg property when generated.
Encode Payload
The JWT Claims Set should be a JSON object.
"alg":"none" and an empty third segment. It provides no authenticity protection.Generated JWT
—
JWTs and secrets are processed locally and are not uploaded to Flipper File. HMAC signing and verification use the browser Web Crypto API. Secrets are not saved to local storage.
Free Online JWT Decoder, Verifier & Encoder
Use this browser-based JSON Web Token tool to decode JWT headers and payloads, verify HMAC signatures, inspect common claims, or generate signed HS256, HS384, and HS512 tokens. JWT data stays on your device while you work.
How to Decode a JWT
- Paste the compact token into the JWT box.
- Click Decode Token.
- Review the formatted JOSE header, claims payload, signature segment, and registered-claim summary.
- Move to the Verify tab if you also have the shared HMAC secret.
The first two JWT segments are Base64URL-encoded, not encrypted. Anyone holding a normal JWT can usually decode them. Trust the token only after its signature and application-specific claims have been validated.
Supported HMAC Algorithms
- HS256 — HMAC using SHA-256.
- HS384 — HMAC using SHA-384.
- HS512 — HMAC using SHA-512.
Verification deliberately reads alg from the token header and only accepts those three HMAC algorithms.
Public-key JWT algorithms such as RS256 and ES256 require a different verification key workflow and are not handled by this tool.
JWT Time Claims
JWT exp, nbf, and iat values are NumericDate timestamps measured in seconds from the Unix epoch.
The tool converts them to readable dates. Expiration and not-before checks can include a small clock-skew allowance.
How to Generate a JWT
- Open the Encode tab and edit the JSON header and payload.
- Select HS256, HS384, or HS512 and enter the shared secret.
- Click Generate Token.
- Copy the compact token or send it back to the decoder for inspection.
Security Notes
- Do not place passwords, API secrets, or other confidential information in a JWT payload unless the token is separately encrypted.
- HMAC JWTs use the same shared secret for signing and verification, so that key must remain confidential.
- This page does not save secrets to local storage.
- For real authentication systems, validate issuer, audience, expiration, not-before, and any application-specific authorization claims in addition to the signature.
Our Full Dev Tool Library
How to Use the JWT Decoder / Encoder
Paste a JWT into the token box and click Decode to view the header, payload, and signature as formatted JSON.
Use Verify with your shared secret to confirm the signature (HS256/384/512), and check claim times like iat, nbf, and exp.
To generate a token, edit the Encode Header and Encode Payload panels, enter a secret (optional), then click Generate Token.
All actions run locally in your browser—no data leaves the page.
Common JWT Questions (FAQ)
What is a JWT?
A JSON Web Token is a compact, URL-safe way to transmit claims (e.g., user ID, roles) between parties. A typical JWT has three parts: header, payload, and signature.
Is this tool secure?
Yes. Decoding, verifying, and encoding happen entirely in your browser via JavaScript and Web Crypto. Tokens and secrets are not sent to a server.
Which algorithms can I verify?
This tool verifies HMAC signatures: HS256, HS384, and HS512.
(Public-key schemes like RS256/ES256 aren’t supported here.)
Why does “Verify” fail on a valid token?
Common reasons: wrong secret, different algorithm than selected, or the token’s exp/nbf claims make it currently invalid.
Check the header’s alg, and confirm your secret matches the issuing system.
Can I edit the decoded payload and re-encode?
Yes. Copy the decoded header/payload JSON into the Encode panels, make changes, and click Generate Token. If you provide a secret, the tool signs it; otherwise it produces an unsigned token.
What do the time claims mean?
iat (issued at), nbf (not before), and exp (expires at) are Unix timestamps (seconds).
The tool renders them as human-readable times and flags past/future context.