Untangle Your Tokens: Master JWT Decoding & Verification
JSON Web Tokens (JWTs) are the "ID cards" of the modern web, but they look like gibberish to the human eye. Our JWT Encoder/Decoder is a free, browser-based tool that lets you peek inside those long strings. Paste a token to instantly read its payload, cryptographically verify its signature or even generate a fresh token for your local development.
The Three-Part Anatomy of a JWT
Every JWT is actually three different pieces of data glued together with dots:
- Header: Tells the system which algorithm was used to sign the token (usually HS256 or RS256).
- Payload: This is where the actual data (claims) lives. It contains the user ID, their name, when the token expires and any other custom data your app needs.
- Signature: The "seal" on the envelope. It proves that the token hasn't been tampered with.
Decoding vs. Verifying: Know the Difference
This is the most important rule of working with JWTs: Anyone can decode a token, but only the holder of the secret key can verify it.
- Decoding: This is just unmasking the data. You don't need a secret key to see who the token belongs to or when it expires.
- Verifying: This is a cryptographic check. It re-calculates the signature to ensure nobody changed the user ID or gave themselves "admin" rights after the token was issued.
Security Tip: Never trust a JWT in your production app until you have verified its signature.
Common Claims You'll See
| Claim | What it means |
|---|---|
sub | Subject (Usually the User ID) |
iss | Issuer (Who created the token) |
exp | Expiration (When it stops working) |
iat | Issued At (When it was created) |
aud | Audience (Who the token is for) |
Real-World Debugging with JWTs
Fixing 401 Unauthorized Errors: If your API is rejecting your requests, paste the token here. The most common culprit is the exp claim: your token might have expired five minutes ago without you realizing it.
Local Development Without a Server: If you're building a protected endpoint and don't want to spin up a whole Auth0 or Firebase instance just to test a "subscriber" role, use our Encoder to craft a custom token and sign it with your local secret.
Security Audits: Use this tool to ensure you aren't accidentally storing sensitive data like passwords or credit card numbers in the payload. Remember: the payload is encoded, not encrypted. Anyone who sees the token can read it.
Private and Secure
Privacy is paramount when handling security tokens. Every calculation, decoding and signature check happens right in your browser. We never send your tokens or secrets to a server. We don't store them, we don't log them and we don't even see them. It's the safest way to debug your authentication flows.