Skip to main content
AllDevToolsHub
🛡️

JWT Generator & Decoder

100% Local

Generate, decode and verify JSON Web Tokens safely.

JWT Generator & Decoder

Waiting for valid token...

Zero Trust Policy

This decoder runs entirely in your browser. The token is never sent to our servers.

Try:
This tool runs entirely in your browser. Your input is never uploaded, logged, or sent to AllDevToolsHub or anyone else, and it keeps working offline once the page has loaded.

Paste a JWT or create a new one. Header, payload, and signature decode into separate panels.

Learn More

JWT Security 101: How to Audit Tokens Without Leaking Secrets

Read Article

JWT Tokens Explained: Decode, Verify & Common Mistakes (2026 Guide)

Read Article

We Fed 200 Malformed JWTs to 5 Libraries: What Actually Broke

A practical test of JWT validation behavior across major libraries, focusing on algorithm confusion, exp requirements, malformed encoding, and real-world verification failures.

Read Article
Overview

What is JWT Generator & Decoder?

Generate JWTs with custom payloads and secrets, or paste any token to inspect its header, payload, and signature. All processing happens locally in browser.
FAQ

Frequently Asked Questions

Reference

Technical Deep Dive

JWT Generator & Decoder

JSON Web Tokens (JWT) are a central part of modern authentication. This tool lets you generate new tokens with custom payloads and secrets, or paste any JWT to see its header, payload, and signature components. All processing happens locally in your browser for maximum security.

Generate and inspect tokens without the jwt.io debugger. Signing happens in this tab; the secret never posts anywhere.

Mint an HS256 token with secret dev-only and claim sub=42. Decode it here: header alg HS256, payload sub 42. Then change one payload character, verify must fail.

Do not use HS256 secrets that exist in production. RS256 verify needs the public key that matches the issuer.

01 Algorithm Selection Matrix

Family Algorithm Type Key Requirement Security Level
HMACHS256/HS512SymmetricShared SecretHigh (Internal)
RSARS256/RS512AsymmetricPrivate/Public PairIndustry Standard
ECDSAES256/ES512AsymmetricElliptic Curve PairModern/Compact
NonenoneNoneN/A⚠️ Insecure

02 Validation & Signing Pipeline

1
Segment Serialization The Header and Payload are Base64URL encoded and concatenated with a dot separator (header.payload).
2
Cryptographic Hashing The concatenated string is hashed using the selected algorithm (SHA-256) and the provided secret/private key.
3
Signature Verification The resulting binary hash is Base64URL encoded and appended as the final segment (header.payload.signature).

03 When You Reach for a JWT Tool

JWTs are easy to read once you understand the format, but mistakes are expensive, a leaked or misconfigured token can mean account takeover. Five realistic moments where this tool is the right answer:

  • 🪪
    Debugging "401 Unauthorized" from your own API Paste the token from your client's network panel, check the exp claim against the current Unix timestamp, verify aud matches what your API expects, confirm iss matches your issuer. 80% of "auth is broken" calls resolve to one of these three claims being wrong.
  • 🔑
    Verifying signatures against your IdP's JWKS Fetch the public key from /.well-known/jwks.json, paste the JWK or PEM into the verifier, and confirm the token is genuinely signed by Auth0/Cognito/Okta/Keycloak rather than a forged token from somewhere else.
  • 🧪
    Generating test tokens for local development Need a token with specific claims for an integration test? Mint one with HS256 + a known secret, drop it into your test fixture, validate against the same secret in the test setup.
  • 🔎
    Auditing third-party SDK tokens Many vendor SDKs hand you opaque-looking strings that are actually JWTs. Decoding reveals what claims they're sending (and whether they're leaking customer data into a third-party telemetry channel).
  • 🎓
    Teaching the format to a teammate The three-segment header.payload.signature structure clicks faster when someone watches you paste a real token and see each segment decode in front of them than when they read RFC 7519.

04 Worked Examples

EXAMPLE 1 · DECODE AN HS256 TOKEN
Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwiZXhwIjoxNzM1NjA2ODAwLCJpYXQiOjE3MzU2MDMyMDB9.kY8C4dQqYn1uYx2nW0XLk6OWvJ8x1u5Y9q2oZc-W3Yw
Header:
{ "alg": "HS256", "typ": "JWT" }
Payload:
{
  "sub": "user_42",
  "exp": 1735606800,   // expires in 1 hour
  "iat": 1735603200
}

Two segments are visible to anyone who has the token. Anything sensitive in the payload, passwords, full names, internal IDs that map to PII, is effectively public.


EXAMPLE 2 · THE "alg: none" ATTACK
Forged header:
{ "alg": "none", "typ": "JWT" }
Attack:

Send header.payload. with an empty signature segment. A vulnerable verifier checks alg, sees "none", and skips signature validation entirely, your forged {"sub": "admin"} payload is accepted as authentic.

Defense:

On every verifier, pin the allowed algorithm list: verify(token, secret, { algorithms: ['HS256'] }). This tool refuses to verify "none" tokens by default.

EXAMPLE 3 · CHECKING EXPIRY MANUALLY
Payload field:
"exp": 1735606800
Compare with current Unix time:
now = Math.floor(Date.now() / 1000)
isExpired = now >= exp

JWT timestamps are seconds, not milliseconds. The single most common JWT bug is comparing exp against Date.now() directly, your tokens appear valid for 1000× their intended lifetime.




05 Related Tools

JWTs touch a wider auth surface than most developers expect, encoding, key generation, and policy reference all live nearby:

📥

JWT Decoder

Decode-only variant for quick payload inspection when you don't need to mint or verify.
🔐

RSA Key Generator

Generate RSA key pairs for RS256/RS512 token signing and verification.
📚

JWT Claims Reference

Every IANA-registered claim, what it means, and which RFC defined it.
✓

Runs 100% in your browser

All processing happens locally. No data leaves your device, no telemetry, no logs, no server round-trips.

You Might Also Need

RJRahul JalavadiyaFounder & Lead Engineer
Last reviewed 2026-07-29