What is a JSON Web Token (JWT)?

A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe string format used to securely transmit verifiable claims between an authentication server and clients.

Is a JWT encrypted by default?

No. Standard JWTs are signed (JWS), not encrypted. Anyone who has the token can decode the Base64URL header and payload. Never place secrets or passwords in a JWT payload.

How does signature verification work?

The signature is generated by hashing the header and payload with a secret key using algorithms like HS256 (HMAC-SHA256) or asymmetric key pairs like RS256. If any part of the token is modified, the signature becomes invalid.

Are my tokens or secrets uploaded to your server?

No. All decoding, claim parsing, and HMAC signature verifications are performed 100% locally in your browser using the native Web Crypto API. Nothing is sent to any server.

100% In-Browser • Zero Server Uploads • Web Crypto API

JWT Encoder, Decoder & Debugger

Decode, inspect, and verify JSON Web Tokens (JWT) in real time. Validate expiration timestamps, inspect claims, and sign custom tokens with HMAC SHA-256 — all calculated locally on your device.

Encoded JWT Token

Header: Algorithm & Type

{
  "alg": "HS256",
  "typ": "JWT"
}

Algorithm: HS256•Type: JWT

Signature Verification

Enter Secret to Verify

HMAC Secret Key (HS256)

Secret is Base64 encodedSig: Bw1x1p1v-o4sM5r7E4u2n5v6w8x9y0z1a2b3c4d5e6f

Payload: Data Claims

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1999999999
}

Token Claims Inspector

Expiration (exp):

May 18, 2033, 03:33:19 AM (1999999999)

Active (in 2401d)

Issued At (iat):

Jan 18, 2018, 01:30:22 AM

3197d ago

Subject (sub):1234567890

Google AdSense Ad SlotHORIZONTAL (Auto-reserves space for 0 Cumulative Layout Shift)

The Anatomy of a JSON Web Token (RFC 7519)

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. A standard token consists of three distinct parts separated by dots (.):

1. Header (Red)

Identifies the signature algorithm (e.g. HS256 or RS256) and token type (JWT). Base64URL-encoded JSON.

2. Payload (Purple)

Contains the claims — user identity, permissions, and timestamps (sub, exp, iat). Readable by anyone who has the token.

3. Signature (Green)

A cryptographic hash of Header + Payload using your secret key. Guarantees the data has not been tampered with in transit.

Standard JWT Registered Claims Cheat Sheet

Claim	Name	Example	Purpose
sub	Subject	"usr_10482"	The unique identifier of the user or entity.
iss	Issuer	"https://auth.kitwharf.com"	Identifies the authority that issued the token.
exp	Expiration Time	1760000000	Unix timestamp after which the token must be rejected.
iat	Issued At	1759900000	Unix timestamp when the token was created.
aud	Audience	"api.kitwharf.com"	The intended recipient or API service for the token.
nbf	Not Before	1759900000	Unix timestamp before which the token must not be accepted.