JWT Decoder and Encoder

Decode JWT headers and payloads, verify HS256 signatures, and generate test tokens without sending anything to a server. Token segments are Base64URL strings — you can also inspect raw data with the Base64 decoder.

Reference

JWT (JSON Web Token) notes

What is JWT (JSON Web Token)?

JWT (JSON Web Token) is a compact, URL-safe token format used to send signed JSON claims between applications, APIs, and identity providers.

How does the JWT (JSON Web Token) tool work?

A JWT contains three Base64URL-encoded parts: header, payload, and signature. A JWT decoder reads the header and payload, while signature verification checks that the token was signed with the expected secret or key. JWT payload data is readable by design, so it should not contain secrets unless the token is encrypted separately.

When should you use JWT (JSON Web Token)?

  • Debugging login sessions and access tokens
  • Inspecting OAuth and OpenID Connect claims
  • Testing API authorization headers
  • Verifying HS256 JWT signatures during development
  • Generating short-lived test tokens for backend services

What are the limitations of JWT (JSON Web Token)?

  • A decoded JWT is not automatically trusted until the signature is verified
  • JWT payloads are encoded, not encrypted, and can be read by anyone who has the token
  • Expired tokens may still decode successfully but should be rejected by applications
  • Token revocation requires server-side state, short expiration times, or a deny list
  • Weak secrets make HMAC-signed tokens vulnerable to guessing attacks

JWT (JSON Web Token) examples

structure header.payload.signature -> Three JWT sections separated by dots
claim {"sub":"123","role":"admin","exp":1893456000} -> Readable JSON payload claims
bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... -> Token used in an Authorization: Bearer header
Related workflow

Security & Identity tools

Security & Identity
UUID v4, v7 and v5 Generator Generate UUID v4, sortable UUID v7, namespace UUID v3/v5, GUID, URN, and hyphenless identifiers, then validate UUID strings locally.
Security & Identity
Hash Generator Generate SHA-1, SHA-256, SHA-384, SHA-512, and BCrypt hashes from text for checksums, password hashing, and integrity checks.
Security & Identity
Password Generator Generate secure random passwords with customizable length, uppercase, lowercase, digits, and symbols for strong credentials.
Automation & Patterns
Cron Expression Builder Build readable cron expressions for scheduled jobs and translate minute, hour, day, month, and weekday fields into plain English.
Data & Encoding
Base64 Encoder and Decoder Encode text or images to Base64, decode Base64 strings back to readable text, and preview image data URLs in the browser.
Data & Encoding
JSON Formatter & Validator Format, validate, pretty print, and minify JSON data in your browser for API responses, configuration files, and debugging.
Data & Encoding
JSON to TypeScript Interface Generator Convert JSON objects into TypeScript interfaces and generate sample JSON from simple TypeScript interfaces in your browser.
Sharing
Custom QR Code Generator Create custom QR codes for URLs, Wi-Fi, vCard, email, SMS, events, and locations with a logo, gradients, module shapes, contrast check, and PNG, SVG, JPEG, or WebP export.
Automation & Patterns
Regex Tester & Debugger Test, debug and replace with regular expressions. Supports Match/Test/Replace modes, positional and named groups, replacement patterns ($1, $&), global matching and detailed match reports.
Data & Encoding
URL Encoder and Decoder Encode and decode URLs, query strings, and text safely for web requests, links, and browser navigation.
Data & Encoding
Timestamp Converter Convert Unix timestamps, ISO dates, local time, UTC time, and timezone offsets directly in your browser.
Data & Encoding
YAML Formatter and YAML to JSON Format simple YAML, convert YAML to JSON, and convert JSON back to readable YAML for configs and manifests.
Text & Documents
Text and JSON Diff Checker Compare two text or JSON snippets side by side and review added, removed, and changed lines locally.
Network & Web
HTTP Headers Analyzer Parse HTTP headers into a table and highlight cache, security, CORS, and content negotiation signals.
Network & Web
CIDR and IP Subnet Calculator Calculate IPv4 network ranges, masks, usable hosts, broadcast addresses, and CIDR prefix details.
Design
Color Converter and Contrast Checker Convert HEX, RGB, and HSL colors and check WCAG contrast ratios for accessible UI color pairs.
Network & Web
User Agent Parser Parse browser user agent strings into browser, engine, operating system, device, and bot hints.
Text & Documents
SQL Formatter Format SQL queries with readable indentation, keyword casing, and line breaks for debugging and reviews.
Text & Documents
Markdown Preview Preview Markdown as HTML, inspect generated markup, and copy rendered HTML without sending text to a server.
Data & Encoding
HTML Entity Encoder and Decoder Encode text as HTML entities, decode entities back to text, and safely prepare snippets for markup.