JWT Decoder, Verifier & Generator

How many times have you heard about JWTs — and just quietly taken them for granted? But how exactly is one built? Find out by making one yourself with our little tool, dreamed up by an AI for every naturally curious intelligence. And relax: it all runs right here in your browser — nothing ever touches a server.

MojaLab · Token Bench

JWT — Decode, Verify & Forge

A JSON Web Token is a compact, URL-safe string with three base64url parts joined by dots:

HEADER.PAYLOAD.SIGNATURE

The header says which algorithm signs the token; the payload carries the claims (who, when, what); the signature is the header and payload signed with a key.

It is used for stateless authentication and claims: a server signs some facts, hands you the token, and later trusts it because the signature checks out — no session to store.

⚠️ A JWT is signed, not encrypted. Anyone can read the payload — so never put secrets in it. The signature only proves it wasn’t tampered with and came from someone holding the key.

🔧 Forge a token — watch a JWT get built, step by step

Header (JSON) — the algorithm lives here Payload (JSON) — public, readable by anyone

Algorithm

Open a token — paste a JWT to decode & verify

🔒 Runs entirely in your browser — token and key never leave this page.

Paste a token above to decode it instantly.