JWT Encoder & Decoder

JWT Encoder & Decoder Online

This tool allows you to encode (create) and decode (inspect) JSON Web Tokens. Use the toggle at the top to switch between modes. Everything runs locally in your browser — your tokens and data are never sent to any server.

What Is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure.

JWT Structure

A JWT consists of three parts separated by dots (.):

• Header (Red) — Contains the token type (JWT) and signing algorithm (HS256, RS256, etc.)
• Payload (Purple) — Contains the claims (statements about the user and additional data)
• Signature (Blue) — Used to verify the token hasn't been altered

Common Uses

• Authentication — After user login, the server generates a JWT that the client uses for subsequent requests
• Information Exchange — Securely transmit information between parties using the signature
• API Security — Stateless authentication for REST APIs and microservices
• Single Sign-On (SSO) — Share authentication state across multiple domains

How to Use

Decoding a JWT

1. Paste your JWT token into the Encoded JWT field (left panel)
2. The header and payload automatically appear in the right panels
3. Check the expiry status and other claims in the payload

Encoding a JWT

1. Click the Encode toggle
2. Edit the header JSON (algorithm and token type)
3. Edit the payload JSON with your claims
4. Enter a secret key if using HMAC algorithms
5. Copy the generated JWT from the left panel

Security Best Practices

• Never commit JWT secrets to version control
• Use HTTPS when transmitting JWTs
• Set appropriate expiration times (exp claim)
• Use strong signing algorithms (avoid "none")
• Validate all claims (issuer, audience, etc.) on the server