Adobe AEM
Back to tool

JWT Decoder & Builder — User Guide

The JWT Decoder & Builder provides a comprehensive toolset for inspecting, decoding, verifying, and generating JSON Web Tokens (JWT) directly in your browser. All decoding, encoding, and Web Crypto signature operations run locally without sending token data or secret keys to any remote server.

Key Features

1. Token Inspector & Color-Coded Decoding

  • Structure Breakdown: Visualizes the token in color-coded segments:
    • Header (Algorithm & Token Type)
    • Payload (Claims & Data)
    • Signature (Cryptographic Proof)
  • Claims Health Inspector: Automatically parses standard claims (exp, iat, nbf) into localized date strings and displays live validity badges (Active, Expired, or Not Yet Valid).
  • Preset Sample Tokens: Quick 1-click presets to test auth flows:
    • Auth0 Standard: Sample OAuth2 / OIDC access token.
    • Staging User: Custom app payload with user role and privileges.
    • Expired Token: Pre-configured expired token for testing validation logic.

2. Signature Verification (HS256 / HS384 / HS512)

  • Supports HMAC-SHA signature verification for HS256, HS384, and HS512 algorithms using browser-native Web Crypto API.
  • Enter your shared secret key in the verification panel to instantly verify whether the token payload and signature match.
  • Displays immediate visual badges: Signature Verified, Invalid Signature, or Unsigned / Public Key Required.

3. Interactive JWT Builder & Signer

  • Construct custom JWT tokens visually:
    • Edit header algorithm (HS256, HS384, HS512).
    • Customize claims payload JSON with full auto-formatting.
    • Generates iat (Issued At) and exp (Expiration) timestamps automatically (e.g., 1 hour expiry presets).
  • Sign tokens with a custom secret key to produce valid JWT strings.
  • 1-click token copy for API testing and Postman integration.

Security & Privacy

  • 100% Client-Side Processing: Tokens, secret keys, and payload data never leave your browser.
  • Payload Visibility Warning: Base64URL encoding used in JWTs is readable by anyone without needing the secret key. Never include sensitive credentials, passwords, or PII in JWT payloads.