JWT Token Decode/Encode

What is a JWT Token?

A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit claims between parties. JWTs are commonly used for authentication and authorization in web APIs, single sign-on (SSO), and microservices.

A JWT has three Base64URL-encoded parts separated by dots: header (algorithm and type), payload (claims such as sub, exp, and custom data), and signature (proves the token was issued with a known secret or private key). Decoding a JWT reveals the claims; validating it confirms the signature and expiration.

Explain JWT Token Decode/Encode with Examples

A JWT is built from three dot-separated parts. Decoding reveals the JSON inside the header and payload. Encoding combines JSON claims with a secret to produce a signed token string.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

your-256-bit-secret

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

How to Decode and Encode JWT Tokens in code?

JWT encoding and decoding can be done in JavaScript, Python, or with this free online tool.

import { SignJWT, jwtVerify } from 'jose';

// Encode (sign) a JWT with HS256
const secret = new TextEncoder().encode('your-256-bit-secret');
const token = await new SignJWT({ name: 'John Doe' })
  .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
  .setSubject('1234567890')
  .setIssuedAt(Math.floor(Date.now() / 1000))
  .sign(secret);

// Decode and verify
const { payload, protectedHeader } = await jwtVerify(token, secret);
console.log(protectedHeader, payload);

import jwt

# Encode
token = jwt.encode(
    {"sub": "1234567890", "name": "John Doe"},
    "your-256-bit-secret",
    algorithm="HS256",
)

# Decode (without verification — inspect only)
header = jwt.get_unverified_header(token)
payload = jwt.decode(token, options={"verify_signature": False})

# Validate signature
verified = jwt.decode(token, "your-256-bit-secret", algorithms=["HS256"])

<!-- JWT is usually sent in Authorization header -->
fetch('/api/user', {
  headers: {
    Authorization: 'Bearer ' + token,
  },
});

Or use our free online tool above for instant results without writing code.

How to Decode JWT Token Using This Tool?

Use the Decode tab to paste any JWT and instantly view its header, payload, and optional signature verification.

1

Open the Decode Tab and Input JWT Token

Switch to Decode and paste your JWT token into the input field. The tool loads with a sample token so you can see how it works.

2

Inspect Header and Payload

The decoded header shows the algorithm (alg) and token type (typ). The payload shows claims like sub, name, exp, and any custom fields as formatted JSON.

3

Verify the Signature (Optional)

Enter your HMAC secret key in the verification field and click Verify Signature to check whether the token was signed with HS256, HS384, or HS512.

4

Review Expiration Claims

If the token includes exp, nbf, or iat claims, the tool displays human-readable dates and whether the token is expired or not yet valid.

5

Encode a New JWT

Switch to the Encode tab, edit the header and payload JSON, choose an algorithm, enter a secret, and click Generate JWT to create a signed token.