How to decode a JWT and sign one locally
Read header and payload in the browser, then mint HS256 tokens without uploading secrets — and why decode is not verify.
Decode is not verify
A JSON Web Token is three Base64URL segments joined by dots: header, payload, and signature. Anyone can decode the first two. The signature only proves that someone who knew a secret (HMAC) or private key (RSA/ECDSA) produced the token. Toolora’s JWT Decoder parses header and payload with a Base64URL decoder and JSON.parse, then pretty-prints them plus the raw signature string. It never checks HMAC or RSA. A token with an empty third segment still decodes. Invalid Base64 or a non-JSON payload shows an error. Example: the sample header {"alg":"HS256","typ":"JWT"} with payload {"sub":"1234","name":"Ada"} is readable without any secret. Do not treat a green decode as “this session is trusted.”
When to paste a token here
Use the decoder when an Authorization: Bearer value, a cookie, or a log line looks like three dotted parts and you want exp, sub, or alg without sending the token to a third-party site. Invalid tokens are not written to session storage, so a half-typed JWT will not stick after refresh. Close the tab when the token is a live session. Production secrets and refresh tokens do not belong on a shared machine.
Signing with JWT Encoder
JWT Encoder mint HS256, HS384, or HS512 tokens from a JSON payload and a secret that stays in the tab. The All Algorithms table signs the same claims with each HMAC option. Invalid JSON is rejected before signing. This is for local debugging, not for issuing production sessions. Related: HMAC Generator if you need a raw keyed digest rather than a three-part JWT. Hash Generator if you do not have a key at all.
Privacy
Decode and encode run in the browser. Nothing is uploaded. After you inspect exp, copy the pretty JSON or close the page. Bookmark the decoder if you inspect tokens often.