JWT Decoder vs JWT Signer
Both tools work with JSON Web Tokens, but they run in opposite directions. The Decoder takes a token you already have and reads it. The Signer takes a payload you write and produces a brand new, signed token.
| JWT Decoder | JWT Signer | |
|---|---|---|
| Primary job | Decode an existing JWT into its header and payload | Build a new JWT from a payload you write, and sign it |
| Input | A compact JWT string (header.payload.signature) | A JSON payload (claims) plus an HMAC secret key |
| Output | Decoded header and payload as JSON, plus issued/expiry times read from iat/exp | A new compact JWT string, Base64Url-encoded |
| Signature handling | Does not verify the signature, Base64URL decoding only, no secret key involved | Computes the HMAC signature with your secret, then re-verifies it against the token it just produced |
| Algorithms | Reads the alg header field for any token (any algorithm name), but performs no cryptographic check | Signs with HMAC only: HS256, HS384, or HS512. No asymmetric algorithms (RS256, ES256, etc.) |
| Secret key required? | No, decoding is just Base64URL + JSON.parse, no key needed | Yes, the HMAC secret is required to sign and to verify |
| Use it when | You have a token (from a login response, a header, a bug report) and want to see its claims or check expiration | You need a fresh test token with specific claims, or want to verify a token's signature against a known secret |
Which one do I want?
If someone handed you a token (from an API response, a cookie, an Authorization header) and you
want to see what's inside it without touching any secret key, use the Decoder. If
you're building or testing an API and need to mint a working token with your own claims and secret, use the
Signer. The Signer is also the one to reach for if you need to confirm a token's
HMAC signature actually matches a given secret, the Decoder has no secret-key field and performs no
cryptographic verification.
Related
JWT Decoder JWT Signer & Verifier ← All comparisons 