JWT Decoder
Decode a JSON Web Token and inspect its header and payload.
This JWT Decoder splits a JSON Web Token into its header and payload and decodes both instantly, so you can inspect claims like expiry, issuer, or subject without server-side tooling. It can also verify an HS256/HS384/HS512 signature locally using the Web Crypto API when you supply the secret — RSA/ECDSA-signed tokens aren't supported yet. Nothing is sent anywhere.
How to use
- 1Paste a JWT into the input.
- 2Its decoded header and payload appear automatically.
- 3Optionally tick "Verify Signature" and enter the secret to check an HS256/HS384/HS512 signature.
Frequently asked questions
What is a JWT (JSON Web Token)?
A JWT is a compact, URL-safe token made of three Base64Url-encoded parts — a header, a payload of claims (like user ID, expiry, roles), and a signature — commonly used for authentication and authorization in web APIs.
What is a JWT decoder used for?
Debugging why a token is rejected (checking its expiry or claims), inspecting what data a login flow actually encodes, or verifying a token's structure during API development — without writing a script to do it.
Does this verify the token signature?
It can, for HMAC-signed tokens (HS256/HS384/HS512) — tick "Verify Signature" and enter the secret. RSA/ECDSA-signed tokens (RS256, ES256, etc.) verify against a public key, which isn't supported yet.
Is my secret sent anywhere?
No. Verification runs entirely in your browser using the Web Crypto API — the secret is never sent, stored, or logged.