Home / Encryption / JWT encoder / decoder
JWT encoder / decoder
Decode a JWT into header and payload with field-by-field explanation, algorithm detection and expiry status — or build one the other way: wrap a payload JSON and sign it with HS256 / HS384 / HS512 (or none for debugging). Decoding does not verify the signature — the page says so explicitly.
Free and no sign-up. JWT encoder / decoder computes and renders entirely in your browser; nothing you enter is uploaded.
More tools in Encryption
- SM2 / SM3 / SM4 — Everything SM in one page: SM2 key pairs and sign/verify, SM4 encryption (CBC / ECB) and SM3 digests, with ciphertext you can cross-verify.
- MD5 — Compute the MD5 digest of a text or a file in real time (32- or 16-character form, upper/lower case). Supports UTF-8 Chinese; files can be picked or dropped and are hashed in chunks with a progress bar. Digest only — the original text cannot be recovered.
- DES / 3DES — DES and 3DES encryption with CBC / ECB / CTR modes, 5 padding options, keys and IV as text or hex (the IV can be generated randomly), ciphertext as hex or Base64.
- Hash calculator — One input, eleven digests: MD5, the SHA-1/2/3 families and RIPEMD-160. HMAC mode (with key) is supported; every row copies in one click.
- AES — AES-128/192/256 encryption with CBC / ECB / CTR / CFB / OFB modes, 5 padding options, keys and IV as text or hex (with random generators), ciphertext as hex or Base64.
- RSA key generator — Generate RSA key pairs locally via Web Crypto: 2048 / 3072 / 4096 bits, exported as PEM text (SPKI public key, PKCS#8 private key) with one-click copy. Keys never touch disk and are gone once the page closes.
- RSA encrypt / decrypt — Encrypt with a PEM public key and decrypt with the private key, or sign / verify directly. OAEP and PKCS1 schemes; long inputs are rejected with a clear hint.
- Password strength — Breaks a password down: length, character mix, entropy and brute-force scale; detects keyboard runs, repeats, years and known weak passwords, with a 0-100 score and advice. Entirely on-device.
Frequently asked questions about JWT encoder / decoder
- Does decoding a JWT expose my token?
- No. Decoding merely splits the token on base64url boundaries right here, with no network requests. But note: a JWT's header and payload are only base64 — anyone holding the token can read them. Its security lies in the unforgeable signature, not in secrecy, so never put sensitive data into the payload.
- Why doesn't this page verify the signature?
- Verification needs the issuer's key (a server-side secret for HMAC families, a public key for RSA / EC), and the secret must never be pasted into any web tool; even public-key verification belongs in server code. This page is for inspecting the token, its algorithm and its expiry; do the formal verification in your own backend.
- What does an expired exp mean?
- exp is the expiry timestamp (in seconds) written by the issuer; the page compares it with the browser's local time and shows expired / not expired with the exact moment. Expiry only means the declared lifetime has passed — other claims are untouched, and whether to trust an expired token is your server's policy.
- What kind of token does the generate tab produce?
- Paste a payload JSON, pick HS256 / HS384 / HS512 and provide the shared secret — the page assembles the token and computes the HMAC signature locally. You can also pick none for an unsigned debug token, or customise the header (alg is forcibly overwritten to the chosen algorithm so it always matches the signature). Tokens can be pasted into the decode tab or jwt.io and will match.
- Is it safe to type my secret into a web page?
- This page is fully static: the secret takes part in one HMAC computation inside browser memory only — nothing is stored, uploaded or tracked. Still, shared secrets are only as safe as your habits: use the random generator for test tokens, never paste a production secret, and keep real issuing and verification in your own backend.
- Do I need to register or pay to use JWT encoder / decoder?
- Almost every tool is free, needs no registration or sign-in and has no usage limit; the few pay-per-use features (such as AI watermark removal, AI image generation, AI upscaling, AI annotation, and AI flowchart, mind-map and Mermaid generation) state their prices on the page.
- Is the data I process with JWT encoder / decoder uploaded to a server?
- No. Calculation and rendering run locally in the browser and your input is never sent to a server; only the IP address page asks our backend for your outbound address when it opens, and that request carries none of your input. Features that need the backend (such as AI watermark removal, AI image generation, AI upscaling, AI annotation, AI flowchart and mind-map generation and "Financial statements – Small Business Accounting Standards") state their upload scope on their own pages.
About Local Toolbox
Local Toolbox gathers the small tools you reach for every day into one place: formatters, encoding converters, date maths, ID card and address parsing, image and QR code handling, password and amount conversion. Open a page and start working — no sign-up, and almost every tool has no usage limit.
Most features compute inside your browser, so your input never leaves your device; the pages are plain static assets, load fast and keep working offline. The IP page asks our backend for your outbound address when it opens and sends none of your input. AI watermark removal, AI background removal, AI image generation and AI upscaling send content to our backend for inference (watermark removal is ¥1 per run; background removal is ¥1 per run; image generation and upscaling are priced by resolution — 2K ¥2, 4K ¥3); AI annotation sends images to a large model that locates the target and returns coordinates (¥0.5 per image, refunded only when every image in the batch fails); AI flowchart, AI mind-map and AI Mermaid chart generation send your text description to a model that builds the diagram (three separate products, charged ¥0.5, ¥0.5 and ¥0.5 per run respectively); and the accounting helper sends the income, expense, social-insurance and balance figures you fill in to generate a report (¥0.5 for the spoken analysis, ¥1 for the report). These features accept Alipay only, upload nothing before payment succeeds, and refund automatically if processing fails.
- Local first: Parsing, conversion, encoding and image processing all happen in your browser and nothing you type is uploaded (AI watermark removal and AI background removal need the image, AI image generation and upscaling need one upload to obtain a URL, AI annotation needs the images for the model, AI résumé rewriting needs your résumé text, AI flowchart and mind-map generation need your text description, and the accounting helper needs the figures you submit).
- Pay per use, prices in plain sight: Almost every tool is free, needs no account and has no usage limit. Only AI watermark removal (¥1 per run), AI background removal (¥1 per run), AI image generation and AI upscaling (2K ¥2, 4K ¥3), AI annotation (¥0.5 per image), AI résumé rewriting (¥0.5 per run), AI flowchart, mind-map and Mermaid chart generation (¥0.5, ¥0.5 and ¥0.5 per run) and the accounting helper (¥0.5 for the spoken analysis, ¥1 for the report) are charged per use. Payment is Alipay only, nothing is uploaded before you pay, and failed runs are refunded automatically.
- One link per tool: Every tool has its own link, so bookmarks and shared URLs always land on the same page.
Links