JWT Decoder & Encoder Studio

Decode, inspect, and generate JSON Web Tokens (JWT) locally. Verify signatures and encode JSON data into HS256 JWTs.

📂 Token Presets:
🔑 Encoded Token (Input)

Token Segment Breakdown

Paste a token above to view segment breakdown
👁️ Decoded Token Details
Header (Algorithm and Type)HEADER
Payload (Claims and Data)PAYLOAD
Signature VerificationSIGNATURE
Enter Secret Key
Algorithm: None
🔒 Processes locally in your browser — zero network transmission.

How the JWT Decoder & Encoder Studio Works

The JWT Decoder & Encoder Studio by DwellixTools is a client-side development tool that decodes JSON Web Tokens (JWT) and generates new tokens entirely inside your web browser.

A JSON Web Token consists of three parts separated by dots (.): a Header, a Payload, and a Signature. This tool lets you work both ways:

  1. JWT Decoder (Token ➔ Data): Splits raw token segments and decodes the Base64Url-encoded strings into human-readable JSON formats in real-time, validating cryptographic signatures locally using the browser’s native Web Crypto API.
  2. JWT Encoder (Data ➔ Token): Input your custom Header JSON, Payload JSON, and HMAC Secret key, and compile a valid, signed JWT locally in real-time.

Key Features

  • 🔴 Color-Coded Segments: Visualizes the raw JWT structure immediately by split-coloring the Header (red), Payload (purple), and Signature (blue) parts.
  • ✍️ Real-Time JWT Generator: Write custom Header/Payload JSON and sign them instantly using a local HMAC secret.
  • 🟣 Interactive Claims Inspector: Decodes payload JSON structures and lists standard claims (like exp, iat, sub, iss) in an easy-to-read table. UNIX epoch timestamps are automatically converted to human-readable date-time formats with status alerts for expired tokens.
  • 🔵 Local Signature Verification: Enter a secret key or paste a public PEM certificate to verify HMAC-SHA256 (HS256) and RS256 signatures. The validation is executed securely in the browser.
  • 🔒 Local Browser-Only Processing: No network requests are made. Your tokens, payloads, secrets, and public keys are processed 100% locally in your browser and are never uploaded or stored.

How to Use the JWT Decoder & Encoder

Decoding an Existing Token (JWT Decoder)

  1. Paste Your Token: Input or paste your complete encoded JWT token into the Encoded JWT Token field.
  2. Review Header & Payload: Inspect the decoded Header and Payload JSON blocks.
  3. Check Claims Explainer: Scroll down to the Claims Explainer table to see descriptions of standard registered claims and translated dates/times.
  4. Verify Signature:
    • For HS256 tokens: Enter your secret key in the HMAC Secret input.
    • For RS256 tokens: Paste the public key PEM block into the RSA Public Key textarea.

Generating a New Token (JWT Encoder)

  1. Select Encoder Mode: Click the JWT Encoder (Data ➔ Token) tab at the top.
  2. Edit JSON Objects: Customize the Header JSON and Payload JSON textareas. Ensure the JSON syntax is valid.
  3. Set HMAC Secret: Input your signing secret in the HMAC Secret (HS256) field.
  4. Copy Generated Token: The signed JWT token will be generated instantly. Click the Copy Encoded JWT button to save it to your clipboard.

Frequently Asked Questions (FAQ)

Are my tokens, secrets, or keys uploaded to DwellixTools servers?

No. All decoding, parsing, encoding, and signature calculations are performed client-side using JavaScript and the browser’s native Web Crypto API (window.crypto.subtle). Your credentials and token data never leave your computer.

Should I use production secrets on public JWT tools?

While this tool processes all data locally in the browser and does not transmit details, it is a general security best practice never to input active production secrets or high-privilege keys on any third-party public web utility. Use mock, dummy, or staging environment keys for validation whenever possible.

How can I verify that no data is transmitted?

You can easily audit this by opening your browser’s Developer Tools (press F12 or Ctrl+Shift+I / Cmd+Option+I), selecting the Network tab, and pasting or typing data. You will observe that zero HTTP requests are initiated as you interact with the encoder or decoder panels.

Which signature algorithms are supported for verification?

We support signature verification for HMAC algorithms (such as HS256, HS384, HS512) and RSA algorithms (such as RS256, RS384, RS512). Ensure that you provide the correct HMAC secret or RSA public key in PEM format.

What are standard registered claims?

Registered claims are standard keys defined by the JWT specifications (RFC 7519) to ensure interoperability. Common claims include iss (issuer), sub (subject), aud (audience), exp (expiration time), and iat (issued at).