JWT Decoder & Encoder
Decode JSON Web Tokens to read the header and payload, check expiry times, verify signatures and create HS256 tokens — without sending your token anywhere.
How it works
- 1
Paste or open your data
Paste text, drop a file onto the editor or click Open file. Load sample shows how the tool works.
- 2
Adjust the options
The result updates as you type. Change the options to get exactly the output you need.
- 3
Copy or download
Copy the result to the clipboard or download it as a file.
Why PixNudge
Nothing is uploaded
Your data is processed in your browser and never sent to a server, so API keys, tokens and customer data stay private.
Instant, even for large files
There is no round trip to a server: results appear as you type, and files of several megabytes are handled smoothly.
Exact numbers
Long numbers such as 64-bit IDs are kept exactly as written instead of being rounded.
Frequently asked questions
Is it safe to paste my token here?
Decoding and verification run in your browser and the token is never sent to a server. Still, treat real tokens like passwords and avoid sharing them.
Does decoding prove that a token is genuine?
No. Anyone can decode a JWT, because the header and payload are only Base64URL-encoded. To check that a token is genuine, enter the secret or public key under Verify signature.
Which algorithms are supported?
HS256, HS384 and HS512 with a shared secret; RS256, RS384, RS512, PS256, PS384 and PS512 with an RSA public key; and ES256, ES384 and ES512 with an EC public key in PEM format. New tokens can be signed with HS256, HS384 or HS512.