Cloudesk

JWT Encoder & Decoder

Create, decode, and verify JSON Web Tokens signed with HMAC algorithms

tools.jwt.encoder.sectionTitle

Encoding vs Encryption

  • JWT tokens are Base64Url-encoded, NOT encrypted. Anyone who holds the token can read the header and payload — never store passwords, private keys, or other sensitive data in a JWT payload.
  • HMAC (HS256/HS384/HS512) creates a digital signature that proves the token was issued by the secret holder. The payload is still plaintext; the signature only ensures integrity.
  • If you need to hide the payload, use JSON Web Encryption (JWE) as defined in RFC 7516. JWE wraps the token contents in a fully encrypted envelope — only the key holder can read it.
  • One-line summary: Encoding = everyone can read; Signing (JWS) = everyone can read but only the secret holder can create; Encryption (JWE) = only the key holder can read.

tools.jwt.kb.title

tools.jwt.kb.headerTitle

tools.jwt.kb.headerBody

tools.jwt.kb.payloadTitle

tools.jwt.kb.payloadBody

tools.jwt.kb.signatureTitle

tools.jwt.kb.signatureBody

tools.jwt.kb.claimsTitle

  • tools.jwt.kb.claim1
  • tools.jwt.kb.claim2
  • tools.jwt.kb.claim3
  • tools.jwt.kb.claim4
  • tools.jwt.kb.claim5

Encoding vs Encryption

  1. 1JWT tokens are Base64Url-encoded, NOT encrypted. Anyone who holds the token can read the header and payload — never store passwords, private keys, or other sensitive data in a JWT payload.
  2. 2HMAC (HS256/HS384/HS512) creates a digital signature that proves the token was issued by the secret holder. The payload is still plaintext; the signature only ensures integrity.
  3. 3If you need to hide the payload, use JSON Web Encryption (JWE) as defined in RFC 7516. JWE wraps the token contents in a fully encrypted envelope — only the key holder can read it.
  4. 4One-line summary: Encoding = everyone can read; Signing (JWS) = everyone can read but only the secret holder can create; Encryption (JWE) = only the key holder can read.