1Use Decode to paste a compact JWT and inspect its header, payload, and signature. The tool also summarizes standard exp, nbf, and iat claims.
2Optionally enter the shared secret and choose Verify signature to check an HS256, HS384, or HS512 HMAC signature. A decoded token is not automatically verified.
3Use Encode to enter a JSON header and payload, choose an HMAC algorithm, enter a secret, and create a compact signed token. Copy the result when complete.
4Keep production secrets private. This browser tool does not send token data or secrets to a server; avoid pasting real credentials into shared or untrusted devices.
Common use cases
✓Inspect JWT headers, payload fields, and registered time-based claims during API debugging.
✓Check whether an HMAC-signed JWT matches a known shared secret.
✓Generate test JWTs for local development and authentication integration tests.
