Skip to content
yutils
JWT Encoder (HMAC)
Example

Input (JWT token)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoieXV0aWxzIiwiZXhwIjoxNzgwMDAwMDAwfQ.signature

Decoded (Header + Payload)

Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "123", "name": "yutils", "exp": 1780000000 }

Note

This tool only decodes. The exp claim is a Unix timestamp in seconds — paste it into the unix-timestamp tool for a human-readable date. Signature verification must happen on your server.

Usage / FAQ

When to use

  • Inspect header/payload contents of a JWT from cookies or Authorization header
  • Quickly read expiration (exp), issued-at (iat), or subject (sub) claims
  • Verify issuer and audience match expectations during debugging
  • Check the algorithm (alg) and key ID (kid) used by your backend
  • Validate token shape visually on the frontend (decode-only, no signature check)

FAQ

Q.Does this verify the signature?
A.No. Signature verification requires the public key — pasting keys into external tools is discouraged. yutils decodes only. Verify on the server or with libraries like `jose`.
Q.Is the token sent anywhere?
A.No. All decoding runs in the browser. The token never reaches yutils or any external API.
Q.If anyone can decode it, how is JWT secure?
A.JWT payloads are designed to be readable — security comes from the signature (only the server's secret key can produce it). Never put sensitive data inside the payload.
Fun facts

  • The official pronunciation of JWT is 'jot'. RFC 7519 §1 literally says: "JWTs are pronounced 'jot'". In practice everyone still says J-W-T. The RFC authors seem to have given up.

    RFC 7519 §1

  • Early JWT libraries accepted the `alg: none` algorithm. If the token's author set the header to "no signature", the server skipped verification. In 2015 this design flaw exposed countless services to forged admin tokens, and most libraries now reject `none` by default.

    Auth0 — JWT none vulnerability

  • JWT payloads are encoded, not encrypted — anyone can Base64URL-decode them and read the contents. Never put passwords, credit card numbers, or other secrets in the payload. JWT's security comes from "the signature cannot be forged", not from confidentiality.

    RFC 7519

Related tools

See all in this category →