Decode JWT headers and payloads, inspect claims, or encode unsigned and HMAC-signed JWTs locally in your browser.
Decode a JSON Web Token when you need to inspect the header, payload, and common claims, or encode a test JWT from header and payload JSON. Decoding and HMAC signing run locally in your browser, and decoded content is not proof that a token is authentic.
Runs locally in your browser. Decoding does not verify signatures, and pasted tokens or signing secrets are not uploaded.Decoded claims will appear here.
Header JSON will appear here.
Payload JSON will appear here.
Copy patterns and edge cases worth checking.
The payload is decoded for inspection only. Signature verification is not performed.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiaWF0IjoxNzE5NjAwMDAwfQ.signature
{
"sub": "1234567890",
"iat": 1719600000
}Unsigned tokens are useful for local fixtures only when your verifier explicitly allows alg none.
Header {"alg":"none","typ":"JWT"} and payload {"sub":"1234567890"}A compact JWT with an empty signature segment.
Date claims are Unix timestamps in seconds.
JWT payload with exp: 2530224000
Expires: Mar 7, 2050 UTC
Short answers before you paste real data.
No. It decodes the header and payload so you can inspect the JSON. A decoded token is not proof that the token is authentic.
Yes. Encode mode can create unsigned JWTs or HMAC-signed JWTs with HS256, HS384, or HS512 using the browser Web Crypto API.
No. Decode and encode actions run in your browser, and JWTs or HMAC secrets are not sent to WebMultitool servers or external APIs.
JWT date claims are Unix timestamps in seconds. The tool shows UTC and your browser's local time, so timezone display can differ from server logs.
Useful next steps that also run locally in your browser.
Encode text to Base64 or decode Base64 back to UTF-8 safely in your browser.
Format, minify, and validate JSON with calm parse errors and copy-ready output.
Encode URL components, decode percent-encoded text, and parse query parameters.