JWT Decode & Sign

Inspect Header/Payload, sign HS256/RS256, verify signatures.

All processing on this page runs locally in your browser unless noted otherwise.

JWT payloads are readable Base64 — never put sensitive plaintext in them.

Alg

JWT

Header

Payload (JSON)

HMAC secret

How to use

Load the public jwt.io HS256 sample token and secret.
Decode payload, then Verify signature.

Sample

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

FAQ

Can I decode without a secret?

Header and payload can be decoded without verification. Signature check needs the key.

Which algorithms are supported?

HS256 and RS256 for sign/verify in v1.0.

Related tools

RSA Toolkit Base Encoding