JWT Builder & Decoder

Construct JWT payloads with standard claims and custom fields, or decode an existing token. No secrets required - 100% client-side.

Last reviewed: June 2026

Reviewed by Shannon Patterson, software engineer - last updated June 2026

New to this tool? Click here for instructions

Header

Algorithm (alg)

Type (typ)

Standard Claims

Issuer (iss)

Subject (sub)

Audience (aud)

JWT ID (jti)

Issued At (iat)

Expires (exp)

Not Before (nbf)

Custom Claims

Paste JWT Token

Standard JWT Claims (RFC 7519)

Claim	Name	Type	Description
`iss`	Issuer	String (URI)	Identifies the principal that issued the token. Usually the auth server URL.
`sub`	Subject	String	Identifies the principal that is the subject of the token. Typically a user ID.
`aud`	Audience	String or Array	Identifies the recipients for which the token is intended.
`exp`	Expiration Time	NumericDate	Unix timestamp after which the token MUST NOT be accepted.
`nbf`	Not Before	NumericDate	Unix timestamp before which the token MUST NOT be accepted.
`iat`	Issued At	NumericDate	Unix timestamp when the token was issued.
`jti`	JWT ID	String	Unique identifier for the token. Prevents replay attacks.

Common Algorithms

Algorithm	Type	Key Size	Notes
HS256	HMAC-SHA256	256-bit secret	Most common. Symmetric - same key signs and verifies.
HS512	HMAC-SHA512	512-bit secret	Stronger HMAC variant. Symmetric.
RS256	RSA-SHA256	2048+ bit RSA	Asymmetric. Private key signs, public key verifies.
ES256	ECDSA-P256-SHA256	256-bit EC	Smaller key than RSA with equivalent security.
none	Unsecured	-	No signature. Never use in production.

Fill in claims above and click Build JWT.

How to Use the JWT Builder

Use Build mode to assemble a header and payload from standard claims, timestamps, and custom claim rows. Click Build JWT to generate a three-part preview with a literal UNSIGNED signature segment. This is useful for understanding JWT shape and payload encoding without handling a secret key in the browser.

Use Decode mode to paste an existing compact JWT. The tool base64url-decodes the first two segments and displays formatted JSON for the header and payload, plus the raw signature segment. Use Reference mode when you need a quick reminder of registered claim names and common algorithms.

When to Use the JWT Builder

This page is best for education, documentation, mock payloads, and debugging token contents. It helps you inspect whether claims such as iss, sub, aud, iat, nbf, exp, and jti are shaped the way your application expects.

Do not use this page to produce production tokens. Real JWT signing and verification belong in trusted server-side code or a vetted authentication service because the verifier must validate the signature, issuer, audience, time-based claims, and key selection rules.

How It Works

The builder serializes the header and payload to JSON, base64url-encodes both pieces, and appends .UNSIGNED. The decoder reverses that base64url encoding for the first two segments. There is no external formatting service, no token upload, no secret field, and no client-side signature verification.

Tips, Edge Cases, and Limitations

A decoded JWT is not automatically trustworthy. Attackers can change the header and payload of an unsigned or poorly verified token. Always verify the signature and registered claims in a trusted environment before accepting authorization decisions.

NumericDate claims in JWTs are Unix timestamps in seconds. Check time zones, clock skew, and expiry windows carefully when copying examples into tests.

Sources Checked

Reference behavior was checked against RFC 7519 for JSON Web Tokens, RFC 7515 for JSON Web Signature, and the IANA JWT claims registry.

Frequently Asked Questions

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.

This tool is designed for building and decoding JWTs. It does not generate signed JWTs because the signing process should be handled server-side to ensure the integrity and authenticity of the token.

Standard JWT claims include iss (Issuer), sub (Subject), aud (Audience), exp (Expiration Time), nbf (Not Before), iat (Issued At), and jti (JWT ID).

Yes, it is safe to decode a JWT in the browser. However, never verify JWTs on the client side. Always verify the signature server-side to ensure the integrity and authenticity of the token.

exp (Expiration Time) is the Unix timestamp after which the token MUST NOT be accepted. iat (Issued At) is the Unix timestamp when the token was issued.

Example walk-through

Build and decode an unsigned JWT preview

Step 1. In Build mode, set alg to HS256 and leave typ as JWT.

Step 2. Add iss as https://auth.example.com, sub as user_abc123, and aud as api.example.com.

Step 3. Add custom claims such as role and email, then click Build JWT.

Step 4. Copy the preview and paste it into Decode mode to confirm the header and payload decode correctly.

Preview shape:
base64url(header).base64url(payload).UNSIGNED

Decoded payload includes:
{
  "iss": "https://auth.example.com",
  "sub": "user_abc123",
  "aud": "api.example.com"
}

Step 5. Treat the preview as documentation or test data only. It is not a signed production token.