What is a JSON Web Token?
A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe string. A JWT consists of three base64url-encoded segments separated by dots: header.payload.signature.
- Header - declares the token type (typ) and signing algorithm (alg).
- Payload - carries the claims (statements about the subject).
- Signature - proves the token wasn't tampered with.
What this tool does
- Decode - Paste any JWT to instantly see its header and payload.
- Verify - Supply a secret (HMAC) or public key (RSA/ECDSA/EdDSA) to cryptographically verify the signature.
- Encode - Build and sign your own JWTs.
Supported algorithms
- HMAC - HS256, HS384, HS512
- RSA PKCS#1 - RS256, RS384, RS512
- RSA-PSS - PS256, PS384, PS512
- ECDSA - ES256, ES384, ES512
- EdDSA - Ed25519, Ed448 (subject to browser WebCrypto support)
Privacy & security
All decoding, signing, and verification happens locally in your browser using the native Web Crypto API. No tokens or keys are ever sent to our servers.
Frequently Asked Questions
Is my token sent to a server?
No. Decoding, verifying, and signing all run locally using the browser's native Web Crypto API. Nothing is uploaded or logged.
Which signing algorithms are supported?
HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, and EdDSA (Ed25519 and Ed448).
Can I verify a token without the secret or public key?
You can decode the header and payload without any key - decoding is just Base64URL. Verifying the signature requires the matching secret (HS) or public key (RS/PS/ES/EdDSA).
What is the difference between decoding and verifying?
Decoding reads the header and payload without checking authenticity - anyone can decode a JWT. Verifying additionally checks the cryptographic signature against a key, confirming the token was not tampered with.
Why did verification fail?
The most common causes are a wrong key/secret, a mismatched algorithm, or a token that was modified after signing. Check that you copied the exact key used to sign it.
