Decode, verify, and generate JWT tokens online. Inspect payload claims with human-readable timestamps, detect expiry, verify HS256/HS384/HS512 signatures, and create signed tokens, all locally in your browser.
The JWT Decoder & Generator lets you inspect, verify, and sign JSON Web Tokens without ever sending them to a server. Decode a token to read its header and claims, verify an HMAC-SHA256 signature against your secret, or mint a new signed token, all locally, so secrets never leave your browser.
Calibrating JWT Forge......
Please wait a moment
A JSON Web Token has three Base64URL parts: a header naming the algorithm, a payload of claims (who the token is for, when it expires), and a signature. Anyone can read the first two, they're encoded, not encrypted, which is why you should never put secrets in the payload.
Drop in a JWT and instantly see the decoded header and payload claims.
Enter the shared secret to confirm the HMAC-SHA256 signature is valid and untampered.
Build a payload, add an expiry claim (1h, 24h, 7d), and sign it with your secret.
Grab the Base64URL-encoded JWT for use in your app or API tests.
Decoding just reveals the claims; it says nothing about whether the token is genuine. Verification recomputes the signature with your secret and checks it matches, proving the token hasn't been altered. This tool does both, side by side.
Your signing secret is the key to forging valid tokens, so pasting it into a server-side tool is risky. Here, generation and verification run entirely in your browser, the secret is used in memory and never transmitted.
Paste your JWT token into the decoder. The tool automatically splits it into header, payload, and signature, displaying each section as formatted JSON. No secret key is needed just to decode the payload.
Yes. Enter your HMAC secret key and the tool verifies the signature locally using the CryptoJS library running in your browser. Your token and secret never leave your device.
Common JWT claims include: sub (user ID), exp (expiration timestamp), iat (issued at), iss (issuer), aud (audience), and custom application claims like roles or permissions.
Decode the token and look at the exp claim, it's a Unix timestamp. The tool automatically checks this against the current time and tells you if the token is expired, valid, or about to expire.
Generally yes, with this tool, because it runs locally in your browser. Never paste JWTs containing sensitive data into online tools that send data to their servers. This tool is safe because nothing is transmitted.
This tool uses HMAC SHA256 (HS256), the most common JWT signing algorithm. It uses a shared secret key for both signing and verification. For RS256 (asymmetric), a different tool with RSA key support is needed.
Paste the token and the tool splits it into header, payload and signature and Base64URL-decodes the first two so you can read the claims as JSON. Decoding happens in your browser, so the token never leaves your device.
Yes. The decoded payload shows the exp (expiry) and iat (issued-at) claims as readable dates, so you can immediately see whether the token is still valid.
No. Everything runs locally in your browser, which makes it safe to inspect real tokens while debugging without exposing them.
Yes. Decoding, verification, and signing all happen locally in your browser, neither the token nor your secret is sent anywhere.
Decode it and read the exp claim; the tool shows the expiry timestamp so you can compare it to the current time.
Tool Guides
Tool GuidesOffline POS is a desktop point-of-sale built for real shops — fast catalogue, cash-drawer discipline, customer credit, inventory and reports, all stored locally on your own machine. Optional FBR invoice reporting is built in for Pakistani retail.
Tool GuidesPhotos carry hidden data like GPS location and camera details. Here's why that matters for privacy and how to strip it before sharing.