About JWT Encoder
A JSON Web Token (JWT, RFC 7519) is a compact string of three Base64URL parts: header, payload, and signature. Decoding here splits the token, reads the first two parts as JSON, and converts the iat, nbf, and exp claims to readable dates. It does not verify the signature. Creating a token signs the header and payload with HMAC SHA-256 (HS256) through the Web Crypto API. Other signing algorithms such as RS256 are not supported.
How to use JWT Encoder
- Type or paste into the "JWT, or a JSON payload when creating a token" box, or press "Use example" to try it with sample data.
- Set "Mode" and "Secret for HS256" if the defaults do not fit.
- The result appears below and updates as you type.
- Copy the result with the copy button, or download it as a file where that is offered.
Questions about JWT Encoder
Is the payload of a JWT encrypted?
No. A standard signed JWT is only Base64URL-encoded, so anyone holding the token can read its payload. The signature prevents tampering, not reading. Never put passwords or other secrets in the payload.
Does this tool verify the token signature?
No. It decodes the header and payload and shows the expiry, but it does not check the signature against a key. A token that decodes cleanly here may still be forged or rejected by your server.
Runs in your browser. Page last updated .