JWT encoder & decoder
Decode, verify and sign JSON Web Tokens with local keys.
Processed locally · No input or result uploaded
Preparing local engine…
JWT questions
Can I decode a JWT without a secret?
Yes. Its header and payload can be read without a key. Treat every decoded claim as untrusted until its signature is verified with the correct local key.
Does decoding verify the signature?
No. Decoding, signature verification and claim validation are separate. A verified signature does not establish authorization, revocation state or permissions in another system.
Are JWTs encrypted?
Signed JWTs are readable, not encrypted. Do not put secrets in their payload. Encrypted JWE and nested JWT formats are unsupported here.
Where is my data processed?
Token and key contents never leave the browser. Processing uses local browser memory and Web Crypto. Same-origin static HTML, JavaScript, CSS and fonts are requested. No tool data is saved. Clipboard contents can persist in your operating system; extensions or malicious software may access browser memory. JavaScript cannot guarantee cryptographic erasure.
What is exp / iat / nbf?
These NumericDate claims use Unix seconds: exp is expiration, iat is issuance and nbf is not before. Present exp and nbf are always checked. Expected issuer, audience and subject must be entered explicitly.
What is the difference between HS256 and RS256?
HS256 uses a shared HMAC secret for signing and verification. RS256 signs with a private RSA key and verifies with a public key. This tool also supports other HMAC, RSA, RSA-PSS and EC variants when browser Web Crypto supports them.
Limits: token 131072, JSON 262144 and key/JWKS 524288 text characters; depth 64; JWKS 256 keys. Viewers paginate large JSON and claims. Nothing is silently removed from signed claims.
JSON Formatter & ValidatorDebug webhooks with WebhookKit
Create a receiving URL, inspect request bodies and headers privately, and control the HTTP response. Start debugging without an account.