JWT Decoder & Encoder
Decode any JSON Web Token, inspect claims, verify HMAC signatures, encode new tokens, and compare two tokens side by side.
Paste a JWT above to watch it split into its 3 parts.
What is a JWT? click to collapse
A JSON Web Token (JWT) is a compact, signed piece of text that proves who you are or what you're allowed to do — a server hands one out after login, and every part of the app can trust it without a database lookup. It's really just 3 pieces, base64url-encoded and joined with dots:
Anyone can decode a JWT and read it — it isn't encrypted. The signature only proves the header and payload weren't altered after the token was issued, and only if you check it against the correct secret or key.
Common questions
What is a JWT, really?
A compact, signed token — 3 base64url parts joined by dots: a header (algorithm/type), a payload (your claims/data), and a signature (a tamper check). Servers issue them after login so every request can prove identity without a database round-trip.
Is it safe to paste my token here?
Yes — everything happens locally in your browser. Nothing you paste is ever uploaded or sent to a server, including in Compare mode where both tokens stay on your device.
What does "exp" mean and how do I read it?
exp is the expiration time, written as a Unix timestamp — the number of seconds since 1 Jan 1970 UTC. The decoder converts it to a readable date and shows a live "expires in…" or "expired…ago" countdown next to it.
Why does it say "Invalid signature"?
It means the secret or key you entered doesn't produce the same signature as the one in the token — either you have the wrong secret, or the header/payload was altered after the token was signed. A valid decode of the header/payload does not mean the token is trustworthy; only a verified signature does.
What's the point of comparing two JWTs?
It's the fastest way to spot exactly what changed between two tokens — e.g. before/after a permissions change, or two environments issuing slightly different claims. Compare mode lines up every claim from both tokens and highlights which ones match, differ, or only exist on one side.
Frequently Asked Questions
Is the JWT decoder free?
Yes, completely free with no account or signup required.
Is my JWT token safe?
All decoding and encoding happens in your browser. Your token is never sent to any server.
What JWT features are included?
Decode a JWT to read its header and payload, verify HMAC signatures, encode a new JWT with a custom header, payload, and secret, and view expiry time.
Can I verify JWT signatures?
Yes. Enter your HMAC secret and the tool verifies whether the token signature is valid for the provided header and payload.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token containing a signed JSON payload. It is widely used for authentication — a server issues a token that clients send with each request to prove identity.
How do I create a JWT token online?
Switch to the Encode tab, fill in the header (algorithm) and payload (claims) as JSON, enter your HMAC secret, and click Encode. The signed JWT is generated instantly.
What JWT algorithms are supported?
This tool supports HMAC-based algorithms: HS256, HS384, and HS512. These use a shared secret key to sign and verify tokens.
What is the difference between HS256 and RS256?
HS256 uses a shared HMAC secret — the same key signs and verifies the token. RS256 uses an RSA private key to sign and a public key to verify, so verification can be public without exposing the signing key.
What is the exp claim and how do I set it?
exp is the expiration timestamp in seconds since Unix epoch (1970-01-01). Add it to your payload as a number, e.g. 'exp': 1893456000. Tokens with an exp in the past are rejected.
What is the difference between JWT and session cookies?
Session cookies store a session ID server-side and require a database lookup. JWTs are stateless — the server validates them using a key with no storage lookup, making them ideal for distributed systems.
Can JWT be used for authorization?
Yes. After authentication, a server issues a JWT containing the user's roles or permissions. Every subsequent request includes the JWT so the server can authorize the action without a database query.
Can I compare two JWT tokens?
Yes. Switch to the Compare tab, paste both tokens, and the tool lines up every claim from both side by side, highlights which ones match or differ, and shows a line-by-line diff of the decoded header and payload.
What does it mean if two JWTs have different claims?
It usually means the tokens were issued for different users, sessions, permission levels, or at different times — for example a role, expiry, or scope claim that changed between the two. The Compare tab shows exactly which claims differ and how.