• Security
Encode or decode JSON Web Tokens in your browser. Inspect header, payload, and expiry — optional HS256 signing, nothing sent to a server.
• About this tool
Encode or decode JWT tokens in your browser. Build header and payload JSON, optionally sign with HS256, or decode existing tokens to inspect claims and expiry.
• FAQ
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange. It has three Base64URL-encoded parts: header, payload, and signature.
Decoding and encoding happen entirely in your browser — the token is never sent to our servers. Still avoid pasting production secrets or live credentials into any web tool.
This tool decodes the header and payload only. Signature verification requires the secret key, which should not be shared with third-party tools.
Provide header and payload JSON. With a secret, the tool signs using HS256. Without a secret, you can create an unsigned alg:none token for testing only.
The 'exp' claim is a Unix timestamp indicating when the token expires. When decoding, this tool converts it to a human-readable date and shows whether the token is expired.
• Related
HTTP Security Headers Checker
Audit the HTTP security headers of any website. Score CSP, HSTS, X-Frame-Options, and more.
Base64 Encoder / Decoder
Encode or decode Base64 strings in your browser. Supports UTF-8 text and raw binary data.
NPM Dependency Confusion Validator
Check if your internal package names exist on the public npm registry. Detect dependency confusion attack vectors.
• automated security
PandaONE runs autonomous agents against your app, validates findings with proof, and opens fixes as pull requests.
Get started