JWT Decoder
Decode and inspect JWT tokens online for free — view the header, payload, and signature, and verify HS256 signatures with a shared secret, instantly inside your browser.
What is a JWT?
A JSON Web Token (JWT) is a compact, three-part string used to represent claims between two parties — most commonly to prove a user is authenticated after logging in. It's made up of a header, a payload, and a signature, each base64url- encoded and separated by periods. The header describes the signing algorithm, the payload carries the actual claims (like a user ID or expiration time), and the signature lets the token's issuer prove it wasn't tampered with.
This tool decodes all three parts of a token, surfaces common claims like issued- at and expiration times, and can verify an HS256 signature against a shared secret you provide — all without the token ever leaving your browser.
GuideHow to use it
How decoding and verification work
A JWT's header and payload are just base64url-encoded JSON, so decoding them is a matter of reversing that encoding and parsing the result — no cryptography required, and no secret needed to read the claims inside. Verifying the signature is different: for an HS256 token, the tool recomputes an HMAC-SHA256 signature over the token's header and payload using the secret you provide, and compares it to the signature embedded in the token. A match confirms the token was signed with that exact secret and hasn't been altered since.
Why it helpsFeatures & benefits
Why this runs entirely in your browser
A JWT often carries a real user session, and its signing secret is sensitive by definition, so neither is ever uploaded. Decoding uses the browser's built-in base64 handling, and signature verification uses the Web Crypto API's HMAC implementation — both running locally in the tab, with nothing sent to a server.
A note on security
Anyone can decode a JWT's header and payload without a secret — that's by design, since a JWT isn't encrypted, only signed. Never put sensitive information directly in a JWT payload, and never paste a production signing secret into a tool you don't fully trust; this one runs entirely client-side and never transmits it, but good practice is to test with a non-production secret whenever possible.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
Yes. A JWT's header and payload are only base64url-encoded, not encrypted, so anyone can read them without knowing the signing secret. Only the signature requires the secret to verify.
Currently only HS256 (HMAC-SHA256), the most common symmetric-key algorithm for JWTs. Tokens signed with RS256 or other algorithms can still be decoded, just not verified here.
A JWT must have exactly three base64url segments separated by periods, each decoding to valid JSON for the header and payload. Anything else is rejected as malformed.
It's the token's `iat` claim, a Unix timestamp marking when the token was created, shown converted to a local date and time.
No. All decoding and verification happens locally in your browser using the Web Crypto API. Nothing pasted here is sent to a server, stored, or shared.