Advertisement
Encode and sign HMAC JWTs with HS256/384/512, decode tokens, and run a browser-based audit for expiry, claims, and token health.
Generate, decode, verify, and audit JSON Web Tokens
Runs in your browser. Nothing is sent to a server.
Set the algorithm, claims, and signing secret.
Valid JSON
Valid JSON
Used locally for HMAC signing. HS256 needs at least 32 bytes.
or press Ctrl + Enter
Your signed JWT and its three segments.
No token yet
Fill in the builder and generate a signed JWT. It appears here.
Build and sign HMAC JWTs with a custom header and payload, or paste a token to decode it and run a security audit. The audit checks HMAC signatures when a secret is supplied, expiration and not-before claims, claim configuration, and token health. RS/EC tokens can be inspected but not signature-verified. Runs entirely on the Web Crypto API — tokens and secrets never leave your browser.
What you get with JWT Encoder, Decoder & Debugger.
Build a custom header and payload, choose HS256/HS384/HS512, enter your secret, and generate a signed JWT instantly.
Paste any JWT to decode its header and payload, and verify HS256/384/512 signatures against your secret. Asymmetric signatures can be inspected but not verified.
Get a health score plus a findings list flagging expired tokens, missing claims, weak configuration, and other issues — with a claim-by-claim breakdown of every field.
Uses the Web Crypto API — tokens and secrets never leave your device.
Follow these steps to get the best results.
Paste a JWT into the input — its header and payload decode instantly, and the security audit runs automatically.
Enter your HMAC secret to check the signature on a pasted token, or switch to Encode mode to build and sign a new one.
Check the health score and claim-by-claim breakdown for expired tokens, missing claims, or weak configuration.
Advertisement
Common questions about JWT Encoder, Decoder & Debugger.
Switch to Encode mode, enter your JSON payload (e.g. {"sub": "user123", "exp": 1700000000}), choose your algorithm (HS256/384/512), enter a secret key (required to sign the token), and click Generate. The signed JWT appears instantly.
Decoding a token runs it through checks for: expired or not-yet-valid tokens, missing or weak algorithm (including the 'none' algorithm vulnerability), missing recommended claims (exp, iss, jti), overly long-lived tokens, clock-skew issues, and signature validity if you provide the secret. Results are summarized as a health score and a detailed findings list.
No. It can sign and verify HS256, HS384, and HS512 HMAC tokens. RS/EC tokens can be decoded and audited, but verifying them requires a public key, which this tool does not accept. Processing still happens locally in your browser.
Processing uses the browser's Web Crypto API, so tokens do not leave your device. Still, avoid pasting production tokens or long-lived secrets into shared or untrusted environments.
Encoding converts the header and payload to Base64URL. Signing adds a cryptographic signature using your secret key, which lets a verifier confirm the token hasn't been tampered with. Both happen together when you generate a token in Encode mode.
Advertisement
Comments
Share feedback, ask questions, or help others use this tool.
Join the discussion
Sign in to comment, reply, and report inappropriate content.