Inspect token
Input: A three-part JWT string
Result: Decoded header and payload fields when the token can be parsed.
JWT
Inspect JWT header and payload data and create HMAC-signed JWTs for development work with HS256, HS384, or HS512 signing modes.
Use this tool to confirm your JWT is being generated with the metadata and claims you expect, or to examine JWTs other systems are creating to discover their properties. Above is a sample JWT you can copy and paste into the decoder to try it out.
ENCODED TOKEN
HEADER
PAYLOAD
DATAVERIFY SIGNATURE
WITH SECRET KEYHMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),)
About this tool
What is JWT Decoder and Signer?
Inspect JWT header and payload data and create HMAC-signed JWTs for development work with HS256, HS384, or HS512 signing modes.
What you can do
- Decode JWT header and payload sections
- Create HMAC-signed JWTs
- Work with HS256, HS384, and HS512 signing choices
How to use JWT Decoder and Signer
- 1Paste a JWT to inspect or enter the payload for signing.
- 2Choose the supported signing algorithm when creating a token.
- 3Review the decoded fields or generated token.
Examples
Tool facts
- Decode
- Header and payload
- Signing algorithms
- HS256, HS384, HS512
- Signature verification
- Not currently provided by this UI
Limitations
- Decoding a JWT does not verify that its signature is authentic; do not trust decoded claims without independent signature and claim validation.
Privacy and data handling
JWTs can contain sensitive claims. Treat pasted tokens and signing secrets as credentials and use test values whenever possible.
FAQ
JWT Decoder and Signer FAQs
Common questions about how JWT Decoder and Signer works and what to expect from the current AiFolder implementation.
?Does decoding a JWT prove it is valid?
No. Header and payload data are readable without verification, so authenticity requires signature validation with the correct key and algorithm.
?Which signing algorithms does this JWT tool support?
The current signer is intended for the HMAC SHA family choices HS256, HS384, and HS512.
?Should I paste a production JWT secret here?
Use test credentials where possible. Production signing secrets should be handled as sensitive credentials and kept out of unnecessary tooling.