JWT Decoder
Decode a JSON Web Token and inspect its claims.
Developer
Developer
Runs offline
JWT Encoder
Build and sign a JSON Web Token with HMAC.
Input
0 charsOutput
0 charsCtrl↵to run
Questions
Which algorithms are supported?
HS256, HS384 and HS512, the HMAC family, which the Web Crypto API implements natively. RS and ES algorithms need an asymmetric private key, which does not belong in a browser tool.
Why should alg never be "none"?
A token with alg set to none carries no signature at all. Libraries that honour the header have historically accepted such tokens as valid, letting anyone forge any claim. Always pin the expected algorithm on the verifying side rather than trusting the header.
Is my signing key sent anywhere?
No. HMAC signing runs in your browser through the Web Crypto API. The key stays in the page and is discarded when you close the tab.
Related tools
Base64 Encode / Decode
Convert text and binary data to Base64 and back.
Encoding
SHA256 Hash Generator
Generate a SHA-256 digest of any text.
Hash & IDs