JWT
JWT Decoder
Decode JWT headers, payloads, and inspect signatures. Everything happens in your browser — no server calls.
Runs entirely in your browser · Your input is never transmitted
TOKEN
0 BReady
DECODED
IDLE—
How to use
- Paste a JWT into the input.
- Decoded header and payload appear on the right.
- Use the 'Verify' field with your HS256 secret to check the signature.
Frequently asked
Is it safe to paste production tokens?
The tool runs entirely client-side — no network calls with your token. Still, treat tokens like credentials: don't paste them into shared machines.
Which algorithms are supported for verification?
HS256, HS384, and HS512 (HMAC). RS*/ES* verification requires the public key and is not implemented in this tool yet.
What does 'expired' mean?
The exp (expiration time) claim in the payload is earlier than the current clock. Check the expiry timestamp against your machine's time.