Decode and inspect JSON Web Tokens (JWT), check HS256/384/512 signatures, or create and sign a test token with your own secret.
A JWT debugger for the token sitting in your Authorization header or a login response, and a generator for test tokens. In Decode mode, paste a token and the header and payload appear as readable JSON immediately, so you can check the claims (sub, exp, iat and others) and the signing algorithm; add a secret to check an HS256, HS384 or HS512 signature. In Encode mode, edit a header and payload, enter a test secret and the tool signs a token with HMAC. Everything runs in your browser, so tokens and secrets are not sent to a server.
For HS256, HS384 and HS512 tokens, yes: enter the shared secret under "Check the signature" and it reports valid or invalid. Tokens signed with RS256, ES256 and similar algorithms need the issuer's public key, which this tool does not handle, so it tells you it cannot check them. Decoding itself never needs a secret.
No. Decoding just reads the Base64URL-encoded claims. It does not confirm the token has not been tampered with or that it has not expired. Only signature verification (and your server checking exp, aud and iss) confirms a token is genuine.
Everything happens client-side and nothing is sent anywhere, but a real production secret should never be pasted into any web page. Use a test secret or a token from a test environment, and rotate any secret you have pasted somewhere you do not control.
It writes the header and payload as compact JSON, Base64URL-encodes each, joins them with a dot, and computes an HMAC of that string with your secret using SHA-256, SHA-384 or SHA-512 (HS256, HS384, HS512). The Base64URL-encoded result becomes the third part. The browser's built-in Web Crypto API does the HMAC, so no library is involved.
A token with alg none has no signature, and a server that accepts it will accept anything an attacker types. This tool refuses to create one so a test token cannot be mistaken for a safe pattern. Choose HS256, HS384 or HS512 and a test secret instead.
HS256 (and HS384, HS512) uses one shared secret both to sign and to verify, so every service that checks the token can also forge one. RS256 uses a private key to sign and a public key to verify, so verifiers cannot mint tokens. This tool signs the HS family only, because RS and ES signing need a private key you should not paste into a web page.
exp is a Unix timestamp in seconds, not milliseconds. "Add iat / exp (+1h)" sets iat to now and exp to one hour later. Keep access-token lifetimes short and check exp on the server; the decoder shows the number as-is, so convert it with the Timestamp Converter if you want to read it.
Both decode a JWT, check HMAC signatures and create HS256 tokens. This tool runs entirely in your browser without loading a third-party page, and it signs the HMAC algorithms only; jwt.io also handles RSA and ECDSA keys. For a side-by-side comparison, see the JWT.io alternative post.
← All tools · Web & API · Blog · Cheat sheets · FAQ