Developer Tools
JWT Decoder and Generator
Decode or generate JWTs locally — secrets never leave your browser.
Runs locally in your browser — your input is not uploaded.
What is this tool?
Paste a JSON Web Token to see its header and payload as formatted JSON, which is handy when debugging login flows, API authentication, or expired sessions. You can also build HS256-signed tokens for local testing without installing a library.
A JWT has three parts: header, payload, and signature. Decoding base64url-decodes the first two segments so you can inspect claims.
Generation builds a token locally. HS256 uses the Web Crypto API with your secret in memory only. The unsigned alg “none” mode is for testing only.
Verification of arbitrary algorithms (RS256, etc.) and production key management are intentionally out of scope.
Treat tokens and secrets as sensitive. Prefer working only with data you already have permission to handle.
How to use the JWT Decoder / Generator
- Decode: paste a JWT and click Decode to view the header and payload as JSON.
- Generate: switch to Generate, edit header/payload JSON, choose HS256 or none, enter a secret, then click Generate JWT.
- Remember: decoding does not verify the signature. Generated tokens are for local testing.
Examples
Structure of a JWT
header.payload.signature — each segment is base64url-encoded JSON (except the signature).
Frequently asked questions
Does ToolForge verify my JWT?
No. Decode mode only decodes. Signature verification is intentionally out of scope for V1 to avoid collecting secrets.
Is my token or secret uploaded?
Never. Decode and generate both happen entirely in your browser.
Which algorithms can I generate?
HS256 (HMAC-SHA256) with a shared secret, or unsigned alg none for local experiments. Asymmetric algorithms are not included yet.
How do I check whether a JWT has expired?
Look at the exp claim in the decoded payload. It is a Unix timestamp in seconds; paste it into the Timestamp Converter to see the exact date and time.
Want more power later?
Premium tools, higher limits, and API access are on the roadmap. V1 stays free and private in your browser.