NinjaFunction (Ninja Function) logo

JWT Encoder / Decoder

Decode, verify, and create JSON Web Tokens — 100% client-side


100% client-side — your token never leaves your browserAll decoding happens locally using JavaScript. Nothing is sent to any server.

Paste a JWT token above to decode it instantly

Nothing is sent to any server

About This Tool

Free online JWT decoder and encoder. Paste any JWT to instantly see the decoded header, payload, and expiry status. Create signed JWTs with HS256, HS384, or HS512. All processing happens locally in your browser — your tokens never leave your device.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way of representing claims to be transferred between two parties. JWTs are commonly used for authentication and information exchange in modern web applications.

A JWT consists of three parts separated by periods (.):

  • Header — Contains the token type (JWT) and the signing algorithm (e.g., HS256). It's base64url-encoded JSON.
  • Payload — Contains the claims (statements about the user and metadata). Also base64url-encoded JSON. Common claims include sub (subject), exp (expiration), iat (issued at), and iss (issuer).
  • Signature — Used to verify the token hasn't been tampered with. Created by signing the encoded header and payload with a secret key (HMAC) or private key (RSA/ECDSA).

The structure looks like this: header.payload.signature

🔑 How to Use

🔹 Decode a JWT

  1. Click the "Decode JWT" tab (default).
  2. Paste your JWT token into the input box.
  3. Header and Payload are automatically decoded and shown as JSON.
  4. Check the expiry badge to see when the token expires.
  5. Optionally enter the secret key and click "Verify" to check the signature.
  6. Click any Copy button to copy individual sections.

🔹 Encode a JWT

  1. Click the "Encode JWT" tab.
  2. Choose your algorithm (HS256, HS384, or HS512).
  3. Enter your secret key.
  4. Edit the Header and Payload JSON directly, or use the claims helper.
  5. Click "Generate JWT Token".
  6. Copy the resulting token.

🔹 Understand Standard Claims

  • iss — Issuer (who created the token)
  • sub — Subject (who the token is about)
  • aud — Audience (who the token is for)
  • exp — Expiration time
  • nbf — Not before (token not valid before this time)
  • iat — Issued at (when the token was created)
  • jti — JWT ID (unique identifier)

🔹 Verify a Signature

  1. Decode an HMAC-signed token (HS256, HS384, or HS512).
  2. In the Signature section, enter the secret key.
  3. Click "Verify".
  4. A green badge means the signature is valid; a red badge means it's invalid (wrong key or token was modified).

💡 Pro Tips

  • ✔ Privacy First – Never paste production tokens into untrusted tools. This tool runs 100% client-side.
  • ✔ Expiry Check – Look for the expiry badge at the top — it's the fastest way to see if a token is still valid.
  • ✔ Timestamp Conversion – Click any Unix timestamp to see it as a human-readable date.
  • ✔ Tamper Detection – If you verify a token and it fails, someone may have modified the payload.
  • ✔ JWT is not encrypted – Anyone can read the payload. Don't put sensitive data (passwords, PII) in a JWT.

A Worked Example

Paste this token into the Decode tab. It was signed with HS256 and the secret my-test-secret:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiIsIm5hbWUiOiJBc2hhIiwiaWF0IjoxNzY3MjI1NjAwLCJleHAiOjE3NjcyMzI4MDB9.mTLGZFvDlYB7l8cnD1Zka9GejOc0vOK2yB1Mu7VWMjY

The header decodes to {"alg":"HS256","typ":"JWT"} and the payload to {"sub":"42","name":"Asha","iat":1767225600,"exp":1767232800}. The iat value is 1 January 2026 at 00:00 UTC and exp is two hours later, at 02:00 UTC, so the token was meant to last two hours and has now expired. Enter my-test-secret and press Verify and the signature checks out. Change one letter of the secret, or one character of the payload, and verification fails.

Common Mistakes

  • Treating a JWT as secret. The payload is only encoded, not encrypted. Anyone with the token can read it, as the example shows, so never put passwords or private data in it.
  • Reading timestamps as milliseconds. exp, iat and nbf are in seconds since 1970. A 13-digit value is milliseconds and points thousands of years into the future.
  • Trusting a token you have not verified. Decoding shows what a token says, not whether it is genuine. Your server must check the signature and the expiry on every request.
  • Accepting the "none" algorithm. A token with alg: none has no signature. Servers should reject it, and only accept the algorithms they expect.
  • Using a short secret. HS256 secrets should be long and random, at least 32 characters. A weak secret can be guessed offline from any token.

Frequently Asked Questions

Is it safe to decode a JWT online?

Yes, if the tool runs entirely in your browser. Our JWT decoder uses client-side JavaScript only — your token is never sent to any server. You can verify this yourself by opening the browser's developer tools and checking the Network tab while using the tool.

What does 'exp' mean in a JWT?

The 'exp' claim is the expiration time of the token, expressed as a Unix timestamp (seconds since January 1, 1970 UTC). After this time, the token should be rejected by the server. Our tool shows a human-friendly 'Expires in 2 hours' or 'Expired 3 days ago' badge to make this easy to understand.

How do I verify a JWT signature?

For HMAC algorithms (HS256, HS384, HS512), paste the token in decode mode, enter your secret key, and click 'Verify'. The tool uses the Web Crypto API to recompute the signature and compares it to the token's signature. If they match, the token is authentic.

Can I decode a JWT without the secret key?

Yes. Decoding (reading the header and payload) does not require the secret key — JWT payloads are just base64url-encoded JSON. However, you need the secret key to verify that the signature is authentic and the token hasn't been tampered with.

Does this tool support RS256 and ES256?

Currently, this tool supports decoding of all JWT algorithms (since decoding only requires base64url decoding), but signing and verification are limited to HMAC algorithms (HS256, HS384, HS512). Asymmetric algorithms like RS256 and ES256 require private/public key pairs and are not yet supported.

Should I paste a live production token here?

The tool never sends it anywhere, but a valid token works like a password until it expires. Prefer test tokens, or tokens that have already expired, and never share a live token in screenshots or chat.

Related Tools

UUID Generator

NinjaFunction's UUID Generator creates unique identifiers (UUIDs, also called GUIDs) in seconds. Choose version 4 for random IDs or version 7 for IDs that sort by time, create up to 1,000 at a time, and copy or download the list. You can also paste any UUID into the checker to see its version. Everything runs in your browser using secure random numbers, so nothing is sent to a server.

Base64 Encoder/Decoder

NinjaFunction's Base64 Converter is a powerful online tool designed to simplify working with Base64-encoded data. Whether you need to encode text into Base64 for secure transmission, decode Base64 strings back to readable text, or convert images (JPG, PNG, GIF) and PDF files to/from Base64 format, our tool provides a seamless solution. With an intuitive interface, you can quickly paste your text, upload files via drag-and-drop, preview results before downloading, and export converted data with just one click. Perfect for developers, designers, and anyone working with data encoding, our converter works entirely in your browser—no server uploads required, ensuring fast processing and complete privacy.

Hash Generator

NinjaFunction's Hash Generator lets you compute MD5, SHA-1, SHA-256 and SHA-512 hashes for any text or file. Everything runs locally in your browser using the Web Crypto API — your data is never uploaded. Perfect for verifying file integrity, checksums, and developer workflows.

URL Encoder / Decoder

NinjaFunction's URL Encoder / Decoder turns text into percent-encoding and back, in your browser. Choose whether you are encoding a single value, such as a search term, or a whole link that should keep its slashes and question marks. Options cover + or %20 for spaces and encoding each line on its own. When decoding, broken parts such as a stray % are left as typed instead of causing an error, and a table shows the name and value of every query string parameter. Nothing you paste is uploaded.

Always FreeAll tools are 100% free to use.
No Sign UpNo registration or login required.
Blazing FastInstant results, always.