Uwarp

Help Us Improve

—

(—)

JWT encode & decode

JWT-encode or decode tokens in the browser—inspect header and payload, sign with HS256. Local-first. No signup.

What is a JWT encoder/decoder?

A JWT encoder/decoder lets you jwt-encode JSON claims into a signed token or decode an existing JSON Web Token into header and payload. Use this free local-first debugger to inspect Base64url parts and optionally verify HS* signatures. It does not encrypt payloads and it does not send tokens to a server.

JWT encode & decode features

A local JWT debugger for developers.

  • JWT-encode with HMAC

    Sign header + payload with HS256, HS384, or HS512 and copy the token.

  • Decode any three-part JWT

    Inspect Base64url header and payload JSON without a server.

  • Optional signature check

    Verify HS* tokens against a signing key when you need it.

  • Local-first

    No signup and no upload of tokens or secrets.

How to encode or decode a JWT

From claims to a token, or back again.

  1. Pick a mode

    Decode to inspect a pasted token, or Encode to jwt-encode new claims.

  2. Fill the fields

    For encode, edit JSON and a signing key. For decode, paste the JWT and optionally verify.

  3. Copy the result

    Copy the token or the pretty-printed header and payload.

Tips for JWT debugging

Safer local jwt-encode workflows.
  • 01

    Never put secrets in the payload

    Anything in the payload is readable after Base64url decode.

  • 02

    Use a long HS key

    Prefer at least 32 characters for HS256. Short secrets are easier to brute-force.

  • 03

    Check exp and iat yourself

    This tool shows claim values; it does not enforce expiration policy for your API.

  • 04

    Keep production keys offline

    Even a local debugger is a place you may paste sensitive material—use throwaway keys when possible.

Great for

When a JWT encode tool helps.

  • API debugging

    Inspect Bearer tokens from logs without spinning up a backend script.

  • Auth prototypes

    Quickly jwt-encode sample claims for local demos.

  • Learning JWTs

    See how header, payload, and signature fit together.

Why use this JWT encoder/decoder

Fast local token inspection and signing.

  • Local-first

    Tokens and signing keys never leave the browser for this tool.

  • Free

    Unlimited encode and decode with no signup.

  • Instant decode

    Header and payload update as you paste or edit.

  • HMAC signing

    Create HS* tokens with Web Crypto—no npm install required in the browser.

Technical notes

How this JWT tool works.
Decode
Splits header.payload.signature, Base64url-decodes UTF-8 JSON for header and payload.
Encode
Sets typ/alg, Base64url-encodes JSON, signs with HMAC via Web Crypto (HS256/384/512).
Verify
Optional HMAC verification for HS* algorithms when a signing key is provided.
Privacy
Client-side only—no network upload of tokens or keys.

Sources & References

JWT standard and browser crypto references.
  • “JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties.”
    — IETF RFC 7519

    RFC 7519 — JSON Web Token (JWT): Defines the JWT claim structure this encoder/decoder inspects and the compact serialization (header.payload.signature). datatracker.ietf.org/doc/html/rfc7519

  • “The SubtleCrypto interface of the Web Crypto API provides a number of low-level cryptographic functions.”
    — MDN Web Docs — SubtleCrypto

    MDN — SubtleCrypto: API used to HMAC-sign and verify HS* JWTs entirely in the browser. developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto

Frequently Asked Questions

Quick answers about this tool—open a question to read more.