Tools/Security/JWT Decoder
All tools

JWT Decoder

Decode JWT headers and payloads locally and inspect time claims. Decoding does not verify the token signature.

Signature not verified
JWT0 characters
Header
Waiting to parse
Payload
Waiting to parse

Input and result notes

JWT headers and payloads can be decoded without validating the signature. Decoding does not prove a token is valid. A server must also check time claims such as exp and nbf, the issuer and the intended audience.

Security
  • Base64 Encoder and Decoder

    Encode UTF-8 text as Base64 or decode a Base64 string to readable text. Copy or download the result in your browser.

  • HMAC Calculator

    Calculate an HMAC for a message and key using SHA-256, SHA-384, or SHA-512 locally in your browser.

  • Webhook Signature Generator

    Generate GitHub, Stripe, or Shopify-style HMAC signatures.

  • Token Entropy

    Estimate a token's character pool, theoretical entropy, and repetition.