A JWT (JSON Web Token) is a compact, three-part token format (header.payload.signature) used to securely transmit information between two parties. It's most commonly used to carry user session/authentication data between API requests.

What does the signature do?

The signature is a cryptographic block that proves the header and payload were produced by someone who knows the secret key, and haven't been tampered with along the way: - Integrity: If even a single character in the header or payload changes, the signature no longer matches. - Authentication: Whoever can verify the signature (by knowing the secret) can be confident the token really came from the expected source. You can test this yourself with this tool by entering the secret used to sign the token in the "Signature Verification" section.

How does this tool support verifying and generating signatures?

It only supports the HMAC family (`none`, `HS256`, `HS384`, `HS512`): - Verifying: On the decode screen, enter the secret used to sign the token and press "Verify" — the signature is recomputed and compared right in your browser. - Generating: On the encode screen, edit the header/payload and enter an HMAC secret to produce a new, correctly signed JWT. - Not supported: Asymmetric algorithms like `RS256` or `ES256` are intentionally unsupported — they require a public/private key pair, which is out of scope for this lightweight browser tool.

What do the "exp" and "iat" fields mean?

Both are Unix timestamps (in seconds): - iat (issued at): When the token was generated. - exp (expiration): When the token stops being valid. If this field is present, the tool automatically shows whether the token has expired.

Is my data sent to a server?

No. Decoding, verifying, and generating all happen entirely in your browser using JavaScript's built-in cryptography API (Web Crypto); the token and secret you enter are never sent to any server.

Tools/💻 Digital Tools/JWT Encoder & Decoder

JWT Encoder & Decoder

Decode a JWT (JSON Web Token) and verify its signature, or generate a new one from a header/payload (HS256/HS384/HS512).

Version 1.0 · Last Updated: August 3, 2026 · Maintained by ToolLarder

JWT

This link carries the token in the URL — avoid sharing a real/sensitive token this way.

Paste a JWT to decode it.

Related Tools

JSON Formatter

Format JSON data into readable pretty-print, or minify it into a single compact line.

JSON Validator

Check whether your JSON data is valid; if not, see exactly which line and column the error is on.

Base64 Encoder & Decoder

Encode text into Base64 format or decode Base64 data back into the original text.

UUID Generator

Generate unique UUID identifiers in v1, v4, or v7 format; create multiple at once.

JWT Encoder & Decoder

Related Tools

Frequently Asked Questions