Tool StudioDecode, verify, and generate JWT & PASETO tokens
Hit a problem, or wish a tool existed?
Tell us what went wrong while using this tool, or suggest a new free tool — we aim to build new tool ideas within 2 days.
Contact usPaste a token
Drop in a JWT or PASETO token to decode.
Inspect the parts
View header/payload/signature broken out and highlighted.
Generate if needed
Build a new token with a custom payload and algorithm.
Paste a JWT or a real PASETO token (v2.public or v4.public) to instantly see its decoded header or version, payload, footer, and signature — or generate a new one from scratch. JWT signatures verify with HS256, HS384, or HS512 given the right secret; PASETO signatures verify with Ed25519 given the token's public key, using the browser's own native Ed25519 implementation — no server round-trip, no external library. Generating a PASETO token without a private key on hand automatically creates a fresh Ed25519 keypair so the result is immediately verifiable. Local (encrypted) PASETO tokens are recognized and their metadata shown, though decrypting the payload itself needs a cipher the browser doesn't provide. Everything — decoding, verifying, and generating, for both formats — runs entirely in your browser; tokens and keys are never transmitted anywhere.
Yes — provide the secret or key and it'll verify the signature is valid.
No, all decoding, verification, and generation happens entirely in your browser.
JWT lets you choose the signing algorithm per token from a large menu, including some historically weak or misconfigured options, which has caused real security vulnerabilities in the wild. PASETO removes that choice — each version locks in one modern, vetted algorithm — trading flexibility for a smaller attack surface.
Yes — this decodes, verifies, and generates real v2.public and v4.public PASETO tokens using the browser's native Ed25519 implementation, not just JWT with a PASETO label attached.
public tokens are signed (with Ed25519) — anyone can read the payload, and a public key can confirm who signed it. local tokens are encrypted (with XChaCha20-Poly1305) — only someone with the shared secret key can read the payload at all.
Not the payload itself — local tokens use XChaCha20-Poly1305, a cipher the browser's built-in Web Crypto API doesn't implement. Its version, purpose, and footer are still shown, since those aren't encrypted, just not the payload without that cipher and the symmetric key.
A raw 32-byte Ed25519 public key, entered as hex or base64 — not a PEM file or certificate, since PASETO deliberately avoids the complex key-format ecosystem that surrounds JWT's RS/ES algorithms.
Yes — leave the private key field blank and a fresh Ed25519 keypair is generated for you. Save the public and private key shown afterward, since they're not stored anywhere and the token can't be verified again without them.
HS256, HS384, and HS512 — HMAC-based algorithms that use a single shared secret. RS/ES/PS algorithms use asymmetric key pairs and aren't supported for verification here.
It's the token's expiration time, as a Unix timestamp. When present, this tool checks it against the current time and flags the token as expired or still valid — a common source of confusing "why did my login just fail" bugs.
Yes — edit the Payload JSON directly before generating, for either JWT or PASETO. An iat (issued-at) claim is added automatically for JWT if you don't include one.
Generation and verification both happen entirely in your browser, with nothing transmitted anywhere — but as a general rule, avoid pasting production secrets into any third-party tool, including this one, when a throwaway test key would do the job just as well.
No — decoding (reading the header and payload) never requires a secret, since that data isn't encrypted, only signed. The secret is only needed for the separate verify step, to confirm the signature wasn't tampered with.
No, not by default — a standard JWT's header and payload are only base64url-encoded and signed, not encrypted, so anyone who has the token can read its contents. Encryption requires the separate JWE standard, a different thing from the signed JWT this tool decodes.
Interactive sorting algorithm visualizer to watch and learn how different sorting algorithms work in real-time. Visualize Bubble Sort, Selection Sort, Insertion Sort, Merge Sort, Quick Sort, and Heap Sort with step-by-step animations. Perfect for computer science students, developers preparing for interviews, and anyone learning data structures and algorithms. Features 6 different sorting algorithms with live visualizations, adjustable speed control from very slow to very fast, variable array size from 10 to 150 elements, real-time statistics showing comparisons and swaps, color-coded visualization with different colors for comparing (yellow), swapping (red), pivot (orange), and sorted (green) elements, live timer tracking execution time, responsive design that works on desktop, tablet, and mobile, dark and light theme support, and educational complexity information for each algorithm showing best, average, worst, and space complexity. Watch every comparison and swap as it happens with smooth animations. Generate new random arrays instantly. Stop and restart sorting at any time. Learn algorithm efficiency by comparing different sorting methods on the same data. Understand time complexity differences between O(n²) and O(n log n) algorithms visually. See how divide-and-conquer algorithms like Merge Sort and Quick Sort partition and solve sub-problems. Observe the heap building process in Heap Sort. All processing happens entirely in your browser with no data sent to servers. Perfect for visual learners, interview preparation, classroom teaching, algorithm comparison, and self-paced education.
Compare two texts side-by-side with color-coded highlighting for additions, deletions, and modifications. Supports line-by-line, word-level, and character-level comparison modes. Perfect for code review, document comparison, and tracking changes.
Search up to 5 words or phrases simultaneously with color-coded highlighting, occurrence counters, and easy navigation — no browser extension to install. Warns you if two search boxes have the same term, and when two terms' matches overlap, the earlier one wins so highlighting never looks broken. Perfect for analyzing documents, finding patterns in large texts, and reviewing content with multiple search terms at once.
Format, validate, and beautify JSON data instantly. Minify JSON, fix formatting errors, and validate JSON syntax online. Perfect for developers working with APIs and configuration files.