JWT Decoder
Decode a JSON Web Token's header, payload and claims and verify HS256 signatures — all in your browser.
How it works
- Paste a JWT — the header and payload are Base64Url-decoded and pretty-printed instantly.
- Read the claims — issued-at, not-before and expiry are shown as readable dates, with an expired/valid badge.
- Optionally verify — for HS256 tokens, paste the secret and the signature is checked locally with the Web Crypto API.
Private by design
A JWT can carry user IDs, roles and session details, so pasting one into a random website is risky. Here everything — decoding and HS256 verification — happens inside your browser and never touches a server. This is enforced by a Content-Security-Policy that blocks the page from talking to any third-party origin. Read more in our privacy policy.
Frequently asked questions
Is my JWT sent to a server?
No. Decoding and signature verification run entirely in your browser using the Web Crypto API. Neither the token nor your secret is ever transmitted — our pages ship a Content-Security-Policy that blocks the page from sending them anywhere. This matters because JWTs often contain sensitive session data.
What does the decoder show?
It splits the token into its three parts and Base64Url-decodes the header and payload into readable JSON, then highlights the standard time claims — issued-at (iat), not-before (nbf) and expiry (exp) — as human-readable dates, and flags whether the token has expired.
Can it verify the signature?
Yes, for HS256 (HMAC-SHA256) tokens. Paste the shared secret and the tool recomputes the signature locally with Web Crypto and tells you whether it matches. RS256 and other asymmetric algorithms aren't verified here.
Does decoding a JWT mean it's trusted?
No. Anyone can read a JWT's payload — it's only Base64-encoded, not encrypted. A token should only be trusted after its signature is verified against the correct secret or public key on your server.
Is it free?
Completely free, with no sign-up and no limits.
Related developer tools
Turn any URL or text into a downloadable QR code (PNG or SVG) — generated in your browser, nothing sent to a server.
Encode text to Base64 or decode it back, UTF-8 safe — runs entirely in your browser, nothing uploaded.
Beautify, minify and validate JSON with clear error messages — processed locally in your browser, never uploaded.
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text — computed in your browser, nothing sent anywhere.