JWT Decoder

Header, payload, signature — decoded in your browser. Optional HS256/384/512 verify.

JWT decoding in your browser. Decode any JWT to inspect it. Verify HS256/384/512 with a shared secret. Nothing sent to a server. How to use ↓·Shortcuts ↓
Paste a JWT — get decoded header, payload, and signature.
Samples:
JWT Input
Decoded
Decoded parts will appear here.
Input: 0 bytes

How to use

Paste a JWT into the input pane. The decoded Header, Payload, and Signature appear on the right as you type.

To verify an HS256/384/512 signature, toggle Verify signature and paste the shared secret. The badge shows valid or invalid immediately. RS*/ES*/PS* verification isn't supported (needs a public key).

Standard time claims (iat, nbf, exp) are shown as human-readable UTC and relative time. An expired token gets a red badge.

Back to top

Keyboard shortcuts

Two shortcuts:

Cmd / Ctrl + KFocus the input pane
Cmd / Ctrl + EnterCopy decoded header + payload as JSON
Back to top

When to use it

JWTs are opaque to the eye but the payload is just base64-encoded JSON. Decoding lets you inspect what you're actually receiving.

  • Debugging an auth flow — is the sub claim what you expect? Are the roles right?
  • Checking if a token has expired without wiring it into your app.
  • Confirming the algorithm your identity provider is using.
  • Sanity-checking an HS256 signature with your shared secret before shipping the code that consumes it.
Back to top

Options

Verify signature — enables HMAC verification. Requires a shared secret. Only works for HS256, HS384, and HS512.

Secret — the UTF-8 shared secret used to compute the HMAC. Never leaves your browser.

Back to top

Format-specific gotchas

Decoding is not verification. Any JWT decodes trivially — the signature is what prevents tampering. If you display decoded contents to a user, always verify the signature first.

The none algorithm is a footgun. Older JWT libraries accepted alg: none as valid, letting attackers forge tokens with no signature. If you see none in a token, question why.

Public-key algorithms aren't supported here. RS256, ES256, PS256, etc. need a public key. Decoding still works; only verification is skipped. Use your JWT library server-side for verification of asymmetric-signed tokens.

Times are in seconds since epoch. Standard JWT claims (iat, nbf, exp) use Unix seconds, not milliseconds. The tool renders both absolute UTC and a relative offset.

Signature format shown as base64url and hex. Copy whichever your consumer expects.

Back to top

Privacy

Everything runs in your browser — the token, the secret, the decoded output. Nothing is sent to a server. Never paste a production token into an online tool you don't control. This tool is safe, but the habit of trusting others isn't.

Back to top

Frequently asked questions

What is a JWT?
A JSON Web Token — three base64url-encoded segments joined by dots: header, payload, signature. Used for authentication and information transfer. The payload is not encrypted; the signature prevents tampering.
Is decoding the same as verifying?
No. Decoding just base64-decodes and parses JSON — anyone can do it, and it proves nothing. Verification checks the signature against a secret (HS*) or public key (RS*, ES*), which is what proves the token is authentic.
Why can I not verify RS256 tokens?
RS256 uses asymmetric cryptography — you need the issuer's public key. That is beyond a simple in-browser tool. Decode still works; use a server-side JWT library for RS*/ES*/PS* verification.
What about the "none" algorithm?
A token signed with alg: none has no signature. Old JWT libraries had a vulnerability where they accepted this as valid — attackers could forge tokens. Modern libraries reject it. If you see none in a real token, question its origin.
Are iat / nbf / exp in milliseconds or seconds?
Seconds since Unix epoch. This is the JWT convention and differs from JavaScript Date.now() (milliseconds). The tool shows both absolute UTC and relative time so you do not have to convert in your head.
Does the tool send my JWT anywhere?
No. Decoding and verification happen entirely in your browser using the Web Crypto API. Neither the token nor the secret leaves the page.
Back to top