Guide · Security
JWT Generate vs Decode - What Belongs in the Browser
Updated 2026-10-23 · 4 min read
Search mixes jwt generator vs decoder online as if both jobs are equally safe in a tab. They are not the same risk.
Decode - read existing header and payload. Low crypto power; still exposes PII in claims if you paste a real session.
Generate - sign new tokens with a secret or private key you provide. That is key material on a web page surface - acceptable for test-secret-do-not-ship, unacceptable for prod-hs256-key.
ToolComb splits JWT Decoder and JWT Generator. Both target browser-local use. This guide routes which to open and what never belongs in either.
Decode: read claims, do not trust them
Three dot-separated segments (typical JWS): header JSON, payload JSON, signature bytes.
Decoder output answers:
- Is
expin the past? - Does
audmatch my API? - What
scopeorrolesdid the IdP attach?
Decoder output does not answer:
- Did the issuer actually sign this?
- Was the key rotated?
- Is the token revoked?
Forged payload with garbage signature can still pretty-print. Only verify with issuer keys fixes that - in your API middleware, not in a decoder UI.
Workflow: copy token from dev tools → strip Bearer → paste in JWT Decoder → read JSON → clear field. Deep primer: What is a JWT?.
Generate: for fixtures, not for login
JWT Generator helps you craft HS256 test tokens or exercise claim shapes your API expects:
- Integration test fixture
- Postman pre-request sketch
- Teaching
exp/nbfbehavior
Use keys that never existed in prod. Rotate if you accidentally pasted a real secret - treat as incident.
RS256 flows need private keys - even more reason to keep signing off random websites. Use your auth library in CI for real asymmetric mint.
Decision table
| Task | Tool | Notes |
|---|---|---|
| "Why is API returning 403?" read scopes | JWT Decoder | Dev/staging token only if policy allows |
| "What does this opaque Bearer blob contain?" | Decoder | Redact email in screenshots |
| "Mint token for unit test" | JWT Generator | Throwaway secret |
| "Issue user session for app" | Your auth server | Not browser generator |
| "Verify signature" | Backend + JWKS | Decoder optional helper |
JWE and five-segment tokens
Encrypted JWTs (JWE) are not readable JSON after a simple Base64 pass. Decoder may fail - that is signal, not user error. Do not paste decryption keys into any site.
Comparison with jwt.io
jwt.io vs browser JWT decoder - feature overlap, different trust and telemetry assumptions. Pick per policy; do not paste prod into either if forbidden.
Hub: Best free security and encoding tools.
Base64 confusion
JWT segments are Base64url, not encryption. Base64 is not encryption. Putting passwords in claims and signing the token still puts passwords in tokens readable to anyone holding the JWT.
What not to paste
Production refresh tokens, long-lived admin JWTs, customer PII exports, private keys, OAuth client secrets. What not to paste into online developer tools.
MIME and HTTP tools (adjacent, not JWT)
Content-Type on JWT responses is usually application/json for OAuth token endpoints - the JWT string itself often rides inside JSON. For MIME and status debugging, see MIME types and HTTP status codes.
Decode to inspect with policy-aware paste. Generate to experiment with disposable keys. Sign production sessions where keys live in vaults, not in browser form fields.
Frequently asked questions
What is the difference between JWT decode and JWT generate?
Decode reads header and payload from an existing token (Base64url JSON). Generate builds a new signed token from claims and a key you supply - a signing operation, not just encoding.
Should I decode production access tokens in the browser?
Only if policy allows. Decoding is not verifying - claims may include PII. Prefer JWT Decoder locally over sites that upload tokens. Redact before screen share.
Is it safe to generate JWTs online for production?
No. Production signing belongs in your auth service with HSM or managed keys. Browser JWT Generator is for local tests, demos, and learning - with throwaway secrets.
Does decoding prove the token is valid?
No. Anyone can forge unsigned-looking structure; verification needs the issuer's key and algorithm checks. See What is a JWT?.
Does ToolComb upload my token or signing key?
Tools are built to run client-side. That does not override company policy banning secret paste into browsers - including on your laptop at a café.
When should I use jwt.io instead?
Compare in jwt.io vs browser JWT decoder. Choose based on paste policy and whether you need verify with a pasted public key only.
Related guides
More reading that links back to the same tools and workflows.
What Is a JWT? How to Decode a Token Without Sharing It
Header, payload, signature - decode locally so tokens never hit a website.
5 min read
JWT.io vs a Browser JWT Decoder: Where to Read a Token
jwt.io is the default debugger. Compare that with a no-account, browser-local decoder when the token might be a live access token.
7 min read
Best Free Security and Encoding Tools
Decode JWTs, hash files, generate passwords, and strip metadata locally. Security utilities that keep tokens and passwords on your device.
6 min read
MIME Types and HTTP Status Codes - Quick Browser Reference
Look up Content-Type suffixes, decode 4xx vs 5xx in logs, and parse URLs and user agents locally when debugging APIs without tab-hopping.
4 min read