OnliKit

JWT Encoder / Decoder

Decode, encode, and verify JWTs with an optional secret or key

Use JWT Encoder / Decoder free in your browser. Free online JWT encoder and decoder. Decode tokens, create signed JWTs, verify with a secret or PEM key, compare payloads, and watch expiry countdowns — runs in your browser, no signup.

Loading tool…

What you can do with JWT Encoder / Decoder

JWT Encoder / Decoder on OnliKit is a free browser tool for everyday work — decode, encode, and verify jwts with an optional secret or key. Use it when you need a quick result without installing software or creating an account.

  • Decode one or many JWTs and inspect header and payload JSON.
  • Encode and sign tokens with HS256, HS384, HS512, or RS256.
  • Verify signatures with a shared secret or PEM key when you provide one.
  • Watch live expiry countdowns from exp, nbf, and iat claims.
  • Diff two token payloads side by side to spot claim changes.
  • Keys and tokens stay in your browser — nothing is uploaded to OnliKit.

Why use JWT Encoder / Decoder?

Use JWT Encoder / Decoder when debugging auth headers, service tokens, or claim changes between environments. Decode without a key, or paste a secret to verify the signature the same way your API would.

Encode mode builds a signed token from editable header and payload JSON, with helpers for iat and exp. Diff mode highlights payload differences when you rotate claims or compare issuer versions.

Signing keys never leave the device. Prefer throwaway secrets for demos, and avoid pasting production keys onto shared screens.

How to use JWT Encoder / Decoder

  1. 01Pick Decode, Encode, Verify, or Diff.
  2. 02Paste a token and optionally a secret or PEM key to verify.
  3. 03In Encode, edit header and payload, choose an algorithm, enter a key, and sign.
  4. 04Copy the decoded JSON or the new JWT when you are done.

Frequently asked questions

Can I create a JWT online?

Yes. Open Encode, edit the header and payload, choose HS* or RS256, enter a secret or private key, and sign. The token is created in your browser.

Can I verify a JWT signature?

Yes. Provide the HMAC secret or PEM key in Decode or Verify mode. Without a key, the tool still decodes header and payload but cannot confirm the signature.

Does decoding a JWT upload my token?

No. Decode, encode, and verify all run locally. Tokens and keys are not sent to OnliKit servers.

Which algorithms are supported?

Signing and verify support HS256, HS384, HS512, and RS256 for everyday debugging. Exotic JOSE algorithms are out of scope for this tool.

Is it safe to paste production secrets?

Prefer test secrets. Everything stays in the browser, but screen sharing or browser extensions could still expose keys you paste.

Related tools

After you finish with JWT Encoder / Decoder, try these related OnliKit tools — or browse all tools.

Also see more dev tools.