Advanced JWT Encoder & Decoder.

A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe string. A JWT consists of three Base64URL-encoded segments separated by dots: the Header (algorithm and token type), the Payload (claims — arbitrary JSON key/value pairs like user ID, roles, or expiry), and the Signature (a cryptographic hash binding the header and payload to a secret or private key). Because the signature is mathematically bound to the content, any tampering with the header or payload invalidates the signature, making JWTs a reliable mechanism for stateless authentication and authorization in REST APIs and microservice architectures.

Switch to Encoder Mode, edit the JSON Header (set "alg" to "HS256") and Payload blocks with your desired claims, then enter your secret signing key. This tool uses the browser's native Web Crypto API — specifically window.crypto.subtle.importKey() and window.crypto.subtle.sign() — to compute the HMAC-SHA256 signature entirely inside your browser sandbox. No payload, secret key, or intermediate value is ever sent to a server. The output is a fully signed, standards-compliant JWT string ready for production API testing.

Yes. This tool operates on a strict static architecture with zero backend infrastructure. There are no server-side endpoints, no request logging, no analytics that read form inputs, and no third-party scripts with access to the DOM state. Every cryptographic operation — key import, HMAC signing, signature verification — runs inside your browser's isolated JavaScript sandbox via the Web Crypto API. Your secret key exists only in your browser's memory for the duration of the tab session and is never transmitted across any network boundary.

HS256 (HMAC-SHA256) is a symmetric algorithm: the same secret key is used to both sign and verify the token. This is simple and fast, but requires every service that needs to verify tokens to possess the secret — creating a shared-secret distribution problem in multi-service architectures. RS256 (RSA-SHA256) is an asymmetric algorithm: tokens are signed with a private key and verified with a corresponding public key. Only the authentication server needs the private key; any downstream service can verify tokens using the freely distributable public key (often exposed as a JWKS endpoint). RS256 is the preferred choice for distributed systems and third-party token issuers.

The iat (Issued At), exp (Expires At), and nbf (Not Before) claims in a JWT are Unix epoch timestamps — the number of seconds elapsed since January 1, 1970 00:00:00 UTC. For example, 1719532800 represents a specific point in time, not a random number. To convert a Unix timestamp to a human-readable date in JavaScript: new Date(timestamp * 1000).toISOString(). To generate a current timestamp: Math.floor(Date.now() / 1000). A common pattern for a 1-hour token is iat = Math.floor(Date.now()/1000) and exp = iat + 3600. Use the quick-inject buttons in Encoder Mode to populate these values automatically.

The most common cause is a whitespace mismatch in the secret key — a trailing newline or leading space will produce a completely different HMAC hash. Other causes include: using a Base64-encoded secret when the library expects the raw string (or vice versa), algorithm mismatch between the token header and the verification config, or copying a token with line breaks introduced by a text editor. Paste the raw JWT and secret key carefully, ensuring no invisible characters are included. This tool trims the token string automatically, but the secret key is used verbatim to match production behavior.