Paste a JSON Web Token to read its header and payload, see human-readable timestamps and check whether it is expired. You can also sign an HS256 token from your own payload. Everything runs locally — tokens and secrets never leave your browser.

Instant header & payload decode

Expiry & claim checks

Sign HS256 tokens

100% client-side

Use the tool now Step by Step

Trusted & free

It is completely free, private and requires no signup.

IDs are not secrets

A UUID identifies a record — never use it as an authentication token.

Use crypto randomness

Math.random() is predictable. Use the CSPRNG for tokens, IDs and secrets.

Never trust a JWT blindly

Decoding is not verifying. Always validate the signature and claims on the server.

Keep secrets out of code

Generate keys here, then store them in environment variables or a vault.

How it works

Paste any JWT into the decode box — the header and payload appear instantly.

Issuer, subject, issued-at and expiry are highlighted with readable dates and an expired/valid badge.

Enter a payload and secret in the sign tab to produce an HS256 token you can test with.

Examples & Data

Claim	Meaning	Example
iss	Issuer	auth.example.com
sub	Subject / user id	1234567890
iat	Issued at (Unix time)	1700000000
exp	Expires at (Unix time)	1700003600

Times are Unix timestamps in seconds — the decoder converts them for you.

All tools

Password Strength Checker

Score any password and estimate crack time

Password Generator

Create strong random passwords up to 128 chars

Random String Generator

Random tokens, IDs and keys with any charset

Passphrase Generator

Memorable multi-word passphrases (Diceware)

TOTP / 2FA Code Generator

Time-based one-time codes and otpauth secrets

Password Breach Checker

Check if a password appeared in known breaches

SHA-256 Generator

Hash text to a 64-char SHA-256 digest

MD5 Generator

Compute the 32-char MD5 checksum of any text

SHA-1 Generator

Generate the 40-char SHA-1 hash of any input

SHA-512 Generator

Hash text to a 128-character SHA-512 digest

HMAC Generator

HMAC-MD5, SHA-1, SHA-256 & SHA-512 with secret key

bcrypt Generator / Checker

Hash passwords with bcrypt and verify hashes

PBKDF2 Key Derivation

Derive keys from a password with salt and iterations

AES Encrypt / Decrypt Text

Encrypt text with AES-256-GCM and a password

File Hash / Checksum

Compute SHA hashes of any file locally

IP Address Checker

Identify IPv4 vs IPv6, public/private and more

IPv4 Calculator

Network, broadcast, hosts, subnet mask & wildcard

IPv6 Calculator

Expand, compress and subnet IPv6 addresses

Subnet Calculator

CIDR ranges, wildcard masks and usable hosts

MAC Address Generator

Random valid MAC addresses, unicast or multicast

Port Checker

Learn what each TCP/UDP port number means

DNS Lookup

Resolve A, AAAA, MX, NS, TXT and CNAME records

WHOIS Lookup

Domain registration, expiry and registrar info

HTTP Header Analyzer

Security, caching & SEO headers explained

User-Agent Parser

Decode browser, OS and device from any UA

MIME Type Lookup

File extension to MIME type reference

HTTP Status Code Lookup

Every status code 1xx–5xx explained

URL Encoder / Decoder

Percent-encode URLs and parse query strings

Color Contrast Checker (WCAG)

Check text contrast against WCAG AA & AAA

UUID / ULID Generator

UUID v4, v7, ULID and NanoID in bulk

JWT Decoder & Signer

Decode, inspect and sign JSON Web Tokens

Base64 Encoder / Decoder

Encode and decode Base64, standard or URL-safe

QR Code Generator

QR codes for links, Wi-Fi and vCards

JSON Formatter & Validator

Format, minify and validate JSON instantly

Unix Timestamp Converter

Convert Unix timestamps to dates and back

Regex Tester

Test regular expressions with live matches

Diff Checker

Compare two texts and highlight differences

Lorem Ipsum Generator

Placeholder paragraphs, sentences or words

Number Base Converter

Convert between binary, octal, decimal and hex

Color Converter (HEX / RGB / HSL)

Convert colors and copy HEX, RGB or HSL

CSV to JSON Converter

Convert CSV to JSON and JSON back to CSV

Case Converter & Slug Generator

camelCase, snake_case, kebab-case, Title & slug

Word & Character Counter

Words, characters, sentences and reading time

Ready to try it?

It is completely free, private and requires no signup.

Use the tool now

100% Free No signup Private & secure

Help Center

Frequently Asked Questions

Yes. Decoding happens fully in your browser; the token is never transmitted. Still, avoid pasting production tokens on shared machines.

No. Anyone can read and forge the payload — only a server-side signature check proves authenticity.

HS256 uses one shared secret for signing and verifying. RS256 uses a private key to sign and a public key to verify.

The decoder does not know your secret, so it can only display the signature. Verification always requires the key.

Bright Coding Network

More Free Tools

Explore the whole collection — no signup, 100% free & private.

Invoice Generator

Create & download PDF invoices

Image Compressor

Compress & convert JPG, WebP, AVIF

You are here

Password Generator

Secure passwords & strength tester

QR Code Generator

QR for URLs, Wi-Fi, email & text

Finance Calculators

Mortgage, loan & compound interest

Currency Converter

Live rates for 60+ currencies

Typing Test

Measure your WPM typing speed

Resume Builder

Professional CVs with PDF export

Developer Tools

JSON, CSV, Base64 & SHA-256

SEO Tools

Meta, SSL, sitemap & robots.txt