JWT Encoder / Decoder – Free Online JSON Web Token Tool
About This JWT Encoder / Decoder
A JSON Web Token is a compact way to pass verified claims between two parties, and it’s the backbone of most modern authentication systems, showing up in API headers, login sessions, and single sign-on flows. This tool lets you build a JWT from scratch by supplying a header and payload, or take an existing token and decode it back into readable JSON, with an option to verify the signature against a secret key.
The BigToolSite Team tested this tool against tokens signed with HS256, HS384, and HS512 to confirm both encoding and signature verification match the expected standard behavior.
On the encode side, you supply the header and payload as JSON, choose a signing algorithm, and provide a secret key to produce a complete, correctly signed token. On the decode side, pasting in any JWT instantly splits it into its header and payload sections in readable JSON, and if you also provide the secret key, the tool verifies whether the signature is valid, invalid, or unable to be checked.
If your JWT payload includes Base64-encoded claims you need to inspect separately, our Base64 encoder/decoder can decode those individually. For formatting the decoded header or payload JSON further, the JSON formatter can clean it up or validate it against a specific spec.
How to Use the JWT Encoder / Decoder
- Choose “Encode JWT” to build a new token, or “Decode & Verify JWT” to inspect an existing one.
- For encoding, enter your header and payload as JSON, choose an algorithm, and provide a secret key.
- Click “Generate JWT” to produce the signed token, then copy it.
- For decoding, paste the full JWT string into the input box.
- Optionally enter the secret key used to sign it to verify the signature.
- Click “Decode & Verify” to see the readable header, payload, and signature verification result.
Example Usage
Enter a payload like {"sub": "1234567890", "name": "John Doe"}, select HS256, and provide a secret key, then click “Generate JWT” to get a complete token string ready to use in an API request or auth header. Going the other direction, paste any JWT you’ve received into the decode tab, and the tool immediately shows the readable header and payload, flagging whether the signature checks out if you supply the matching secret.
Yes, it’s completely free with no signup required and no limits on how many tokens you can encode or decode.
Your data is processed to generate or verify the token and is not saved or logged. Even so, avoid pasting real production secrets into any online tool if you can regenerate the token elsewhere in a trusted environment.
It means the token’s signature doesn’t match what would be expected given the header, payload, and secret key you provided, which usually means the token was altered or the wrong secret was used.
Yes. The header and payload of a JWT are only Base64-encoded, not encrypted, so anyone can decode and read them without a secret. The secret is only required to verify the signature.
It supports HS256, HS384, and HS512, the most common HMAC-based signing algorithms used for JWTs. Asymmetric algorithms like RS256 are not currently supported.
