Developer Tools
JWT Decoder & Encoder
Paste any JWT and instantly see its decoded header and payload, plus the algorithm and expiry status. Verify HS256/384/512 signatures or encode your own tokens — all in your browser.
Header
Payload
Output
What makes this tool different
Instant decode
Header and payload are decoded to formatted JSON instantly, with the alg, signature preview, and exp expiry status.
HMAC signature verify
Verify HS256, HS384, and HS512 signatures locally with Web Crypto — no secret ever leaves your browser.
Encode mode
Build a new token from a payload, choosing HS256/384/512 or an unsecured (none) header.
100% client-side
All decoding, verification, and signing happens in your browser. Nothing is uploaded — your tokens and secrets stay local.
About this tool
JWT Decoder & Encoder: everything you need to know
JSON Web Tokens are everywhere — in OAuth flows, SPAs, API authentication, and microservices. When you need to inspect one, OpenToolLab's JWT decoder gives you the header and payload as readable JSON instantly, without uploading anything.
The tool splits the token into its three parts, base64-decodes the header and payload, and shows the algorithm, a signature preview, and the expiry status of the exp claim. Asymmetric keys can't be verified client-side, but HS256/384/512 tokens can.
For HMAC-signed tokens, you can paste the shared secret and verify the signature locally with the browser's Web Crypto. The secret never leaves your device — unlike hosted decoders that would see both the token and the secret.
The built-in encoder lets you build a token from a JSON payload, choosing HS256, HS384, HS512, or an unsecured header for testing. That makes it handy for generating test tokens in development.
Because everything runs in your browser, the tool works offline, needs no signup, and never sees your data. It pairs naturally with OpenToolLab's HMAC generator and hash generator for related signing work.
FAQ
JWT Decoder & Encoder — frequently asked questions
How do I decode a JWT online?
Paste the JWT into the input box and click Decode. The tool base64-decodes the header and payload and shows them as formatted JSON, plus the algorithm, signature, and expiry status.
What's inside a JWT header, payload, and signature?
The header declares the algorithm (like HS256), the payload holds claims such as sub, name, iat, and exp, and the signature is an HMAC or asymmetric signature over the first two parts that proves the token wasn't tampered with.
Can I verify the JWT signature?
Yes — for HS256, HS384, and HS512 tokens. Enter the HMAC secret and click Verify signature; the tool checks it locally with Web Crypto and tells you if it's valid. Asymmetric algorithms (RS/ES) can't be verified without a public key.
What is JWT used for?
JWTs are used for authentication and authorization — for example, access and refresh tokens in OAuth, session tokens in SPAs, and signed payloads passed between services. They're compact, URL-safe, and self-contained.
How do I decode a JWT in Python?
Use the PyJWT library: jwt.decode(token, options={'verify_signature': False}) to read it without verifying. To verify, pass the secret and expected algorithms. For a quick one-off check, this online tool does it instantly.
How do I decode a JWT in Flutter?
In Flutter, the jwt_decoder package or the base64url package can split and decode the three parts. For a fast check without writing code, paste the token here and click Decode.
Is it safe to decode a JWT here?
Yes. Everything happens locally in your browser — no token data is uploaded, stored, or tracked. The HMAC secret you enter for verification never leaves your device either.
Does it support both decoding and encoding?
Yes. Use Decode mode to read and verify tokens, or switch to Encode mode to build a new token from a JSON payload with HS256/384/512 or an unsecured header.
Keep exploring