Developer Tools
JWT Decoder / Generator
Decode or generate JWTs locally — secrets never leave your browser.
Runs locally in your browser — your input is not uploaded.
How to use
- Decode: paste a JWT and click Decode to view the header and payload as JSON.
- Generate: switch to Generate, edit header/payload JSON, choose HS256 or none, enter a secret, then click Generate JWT.
- Remember: decoding does not verify the signature. Generated tokens are for local testing.
About this tool
A JWT has three parts: header, payload, and signature. Decoding base64url-decodes the first two segments so you can inspect claims.
Generation builds a token locally. HS256 uses the Web Crypto API with your secret in memory only. The unsigned alg “none” mode is for testing only.
Verification of arbitrary algorithms (RS256, etc.) and production key management are intentionally out of scope.
Treat tokens and secrets as sensitive. Prefer working only with data you already have permission to handle.
Examples
Structure of a JWT
header.payload.signature — each segment is base64url-encoded JSON (except the signature).
FAQ
Does ToolForge verify my JWT?
No. Decode mode only decodes. Signature verification is intentionally out of scope for V1 to avoid collecting secrets.
Is my token or secret uploaded?
Never. Decode and generate both happen entirely in your browser.
Which algorithms can I generate?
HS256 (HMAC-SHA256) with a shared secret, or unsigned alg none for local experiments. Asymmetric algorithms are not included yet.
Related tools
Want more power later?
Premium tools, higher limits, and API access are on the roadmap. V1 stays free and private in your browser.