← /tools / jwt
Decode, encode, and attack JSON Web Tokens. All operations happen in your browser via the jose library — nothing is transmitted to any server.
Runs entirely in your browser — nothing is uploaded and no network request fires on use.
Paste a token to decode it into the editable fields below. Flip any claim (e.g. admin: false → true), then re-sign with a key you control. The signature is not verified on load.
No custom header claims.
Values parsed as JSON when possible; otherwise treated as strings. alg / typ are owned by the fields above.
No custom claims yet.
Values parsed as JSON when possible; otherwise treated as strings.
{
"alg": "HS256",
"typ": "JWT"
}{}