# JWT Encoder & Decoder

> Decode any JWT and inspect its header, payload, and signature. Encode new tokens with HS256, RS256, and more.

- URL: https://generate.now/jwt
- Category: auth
- Price: free, no account required
- AI-powered: no
- Last updated: 2026-08-27

## What it does

Paste a JWT to see its three parts broken out with claim explanations and expiry status, or build a new token by filling in the header and payload. Supports HS256, HS384, HS512, RS256, RS384, and RS512. Runs entirely in your browser — nothing is sent to a server.

## When to use it

- Debug a 401 by inspecting the token your client is sending
- Verify that 'exp' is set correctly before shipping a login flow
- Generate a test token with a known secret for local development
- Quickly check whether a payload contains the claims you expect

## Examples

### eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNzAwMDAwMDAwfQ.signature

```
{ alg: HS256, sub: 1234567890, name: Jane Doe, iat: 1700000000 }
```

Decoded header and payload. The signature is shown but not verified without a secret.

### Build a token with sub=alex, exp=+1h, secret=supersecret

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

Signed with HS256 using the provided secret.

### Decode a token with an expired exp claim

```
{ sub: "u_8823", exp: 1735689600 } — expired 2 January 2025
```

The decoder resolves exp to a readable date and flags the token as expired.

### Verify HS256 signature with secret "supersecret"

```
Signature valid · alg HS256 · payload unmodified
```

Supplying the secret turns decoding into verification — without it the signature is shown but unchecked.

## Frequently asked questions

### Is it safe to paste a JWT here?

All decoding happens in your browser using the jose library — your token never reaches our servers. That said, a JWT can be replayed if it's still valid, so don't paste production tokens into any random site (including this one) without rotating them afterwards.

### How is decoding different from verification?

Decoding splits a JWT into its base64url-encoded parts so you can read them. Verification checks the signature against a known key. The decoder shows you both halves — but it only verifies if you provide the matching secret or public key.

### What's the difference between HS256 and RS256?

HS256 uses a shared secret (HMAC SHA-256) — same key signs and verifies. RS256 uses an RSA private/public key pair — the private key signs, the public key verifies. Use RS256 when the verifier doesn't need to mint tokens.

### Why does my token say 'expired'?

The 'exp' claim is a Unix timestamp. If it's earlier than the current time, the token has expired and most verifiers will reject it. The decoder shows a human-readable expiry next to the claim.

### Can I edit a payload and re-sign?

Yes — switch to encode mode, paste the header and payload, set the algorithm, and provide a secret or private key. The tool produces a fresh signed token.

### Do you support encrypted JWTs (JWE)?

Not yet. The decoder handles JWS (signed) tokens. JWE support is on the roadmap — let us know if you need it.

## References

- [RFC 7519: JSON Web Token](https://datatracker.ietf.org/doc/html/rfc7519) — IETF. Defines the JWT format and the registered claims including exp, iat, sub, and aud.
- [RFC 7515: JSON Web Signature](https://datatracker.ietf.org/doc/html/rfc7515) — IETF. Defines the signing structure behind the three-part token this tool decodes.
- [RFC 7518: JSON Web Algorithms](https://datatracker.ietf.org/doc/html/rfc7518) — IETF. The algorithm registry covering HS256, RS256, and the rest of the alg values.
- [JSON Web Token Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html) — OWASP. Common JWT vulnerabilities, including algorithm confusion and missing expiry validation.

## Related tools

- [API Key Generator](https://generate.now/api-key): Strong API keys and secrets with prefix support — sk_test_, pk_live_, or your own. Configurable length and charset, bulk mode.
- [Hash Generator](https://generate.now/hash): Hash a string with MD5, SHA-1, SHA-256, SHA-512, or bcrypt. Compare two hashes side by side.
- [UUID Generator](https://generate.now/uuid): Generate UUIDs (v1, v4, v7, v8) in bulk, with format options and a validator. Cryptographically random by default.