Coder — Tips & Tricks

Back to the overview: Coder · Open the tool: www.jpkc.com/tools/coder/

The manual explains every tab, the examples show the workflows. This page is about what both assume but rarely state: when a tab does something other than you expect, and what to watch for to use it safely.

JWT: decode is not verify

The most important point first, because a dangerous misunderstanding lurks here:

• Decoding proves nothing. In a JWT, the header and payload are merely Base64URL-encoded, not encrypted. Anyone can read them — and anyone can write them. What the JWT tab shows when you paste a token is what the token claims. Seeing "admin": true or a valid exp only means someone put it there.
• Only "Signature verified" counts. The Coder can verify the signature — with the secret for HS256/384/512, with the public key (PEM, JWK, or JWKS) for RS, PS, ES, and EdDSA tokens. Only when it says "✓ Signature verified" was the token signed with exactly that key.
• The status badges are display only. "Within its validity period", "Expired", and "Not valid yet" rely on the payload's exp and nbf and on your computer's clock. Without a verified signature, a forged token can carry any time window it likes.
• A signature is not authorization. Even a valid signature says nothing about whether the token is meant for your application. The tool doesn't check issuer (iss) or audience (aud) — that's your server's job, as is the actual access decision.
• A public key never belongs to HS256. If a token claims alg: HS256 and all you have is a public RSA or EC key, the Coder refuses to verify and points to algorithm confusion. Take that seriously: this is exactly what forged tokens look like that a badly configured library would accept.
• Never accept alg: none. The tool flags a token without a signature in red with "never accept it" — rightly so.
• Privacy works in your favor here: decoding and verifying run entirely in the browser; token, secret, and key don't leave your machine and are never stored. That's a real advantage over many online JWT debuggers. Still, production tokens and secrets don't belong in other people's hands — inspect them, but don't pass them on.

Pick the right tab

Many "it doesn't work" moments are really the wrong tab or mode:

• HTML: quotes or no quotes. The Encode quotes option is on by default and makes the text safe for attributes. If you only need it between tags and the " get in the way, switch it off.
• URL: Component, Form, or Full URL. For a single query value or path segment, use Component (%20 for spaces). For form bodies and systems that expect +, use Form. Encode a complete address with Full URL — with Component, even : and / would turn into %3A and %2F.
• Base64 and Base64URL. When decoding, you don't have to tell them apart — the Base64 tab accepts both alphabets and missing padding. When encoding, the URL-safe option decides. A JWT still belongs in the JWT tab, because that one takes all three parts apart at once and explains them.
• Unicode, HTML, or JSON? Numeric entities for an HTML document come from the HTML tab with Non-ASCII as ä (decimal, ä) or from the Unicode tab with format HTML (hexadecimal, ä). For a complete JSON string, use the JSON tab; for individual characters in JavaScript, Java, or CSS source, the Unicode tab.
• JSON tab ≠ JSON formatter. The JSON tab escapes and unescapes string values; it doesn't format or validate documents. For that, the JSON Editor is the right tool.

Pitfalls from practice

• Double-encoded? Step back one level at a time. The HTML decoder unwinds exactly one level (< → <). That's deliberate, so you can see what's happening. For the next level, click Use output as input and Decode again; Ctrl+Z in the input editor restores the previous state. The same works for URL values encoded several times or Base64 inside Base64.
• Binary data is not an error. If Base64, Hex, or Quoted-Printable doesn't yield text on decode, you get a hex dump. The first bytes often reveal the type (89 50 4e 47 = PNG, 25 50 44 46 = PDF); the download button delivers the complete file.
• "… not valid UTF-8" on URL decode usually means legacy data in Latin-1 (%E4 instead of %C3%A4 for ä). Such strings come from old systems and can't be read directly in the Coder.
• CSS escapes are only decoded with format CSS. If the Unicode tab is set to another format, sequences like \E4 stay as they are — so that \n or \f in ordinary text aren't misinterpreted. Set the format to CSS, and it works.
• Punycode and ß. The Coder implements the Punycode algorithm directly. Browsers additionally apply their own mapping rules first, so in special cases such as ß their result can differ. For common umlaut domains the result is identical.
• Live mode with large data. From 512 KB it pauses by itself. For big Base64 blocks you're better off clicking Encode or Decode deliberately anyway.
• Data URIs get big fast. Base64 inflates the data by about a third; from roughly 32 KB the tool warns you, from 10 MB it asks first. Great for icons and tiny assets — with large images, the URI slows the page down rather than helping. And the MIME type comes from browser detection: if there isn't one, the info line says "unknown type".

Privacy: remember only when needed

• By default, the Coder forgets everything. Unless you switch on Remember input and recent entries in this browser, it stores no input — only the selected tab and the options.
• Turning it on is worthwhile for harmless data, for instance if you regularly need the same Punycode domains or HTML snippets. The last ten inputs are then waiting in the Recent inputs menu.
• On shared computers, switch it off and clean up. Base64 strings and URLs often contain credentials. Forget stored entries deletes stored input and the list completely, including entries from older versions of the tool. JWTs are never stored anyway.
• Link tabs directly: the fragment in the address bar (#jwt, #punycode, #base64 …) opens the tab you want. A bookmark to https://www.jpkc.com/tools/coder/#jwt takes you straight to the token checker.

Combine with other JPKCom tools

The Coder is the quick Swiss Army knife for encode/decode. For anything bigger, neighboring tools take over:

• Convertor PRO — when you don't just want to encode but convert between formats: text between 13 encodings, data between JSON, YAML, TOML, XML, and INI.
• JSON Editor — the perfect next stop for a decoded JWT payload or an unescaped JSON string: format, validate, restructure.
• Hash tool — hashes, HMAC, and checksums, plus password hashes with bcrypt, Argon2id, and PBKDF2.
• Generator — passwords, keys, and TOTP codes, such as a sufficiently long secret for HS256-signed tokens.
• Beautify — when the HTML or JavaScript snippet you just escaped should also be cleanly formatted.

Workflow pattern: encode/decode in the Coder → process further in the right neighbor tool when needed. A concrete walkthrough is in Example 2: Decode a JWT and verify its signature.

More context: the overview for the big picture, the manual for every tab in detail, and the examples for the step-by-step workflows. You can try everything right in the tool.