JWT Decoder
Decode a JSON Web Token entirely in your browser.
The header and payload are decoded locally with no network request involved. HS256 signatures can be verified against a secret you provide, which is used only in-browser via the Web Crypto API and never transmitted.
JWT Decoder
Paste a JSON Web Token to inspect its header, payload, and expiry. Decoded entirely in your browser.
Decoded header will appear hereDecoded payload will appear hereSignature will appear hereVerify Signature
Decode a token above to verify its signature.
A JWT (JSON Web Token) is three base64url-encoded segments separated by dots: a header describing the signing algorithm, a payload of claims, and a signature that lets a party holding the signing key detect tampering. Decoding the header and payload requires no key at all: they are encoded, not encrypted, so anyone can read them. Only the signature step actually needs a secret or private key.
What a JWT Actually Contains
A JSON Web Token is three base64url segments joined by dots: header.payload.signature. The header names the signing algorithm and token type. The payload carries claims, arbitrary key-value data such as a subject, an expiry, or custom application fields. Both are plain JSON, base64url-encoded for safe transport in URLs and headers, not encrypted. Anyone holding the token can decode the first two segments without any key at all.
The signatureis where the security lives. It is computed over the header and payload using a secret (for symmetric algorithms like HS256) or a private key (for asymmetric algorithms like RS256 or ES256). A verifier with the matching secret or public key can recompute the signature and confirm the token was issued by a party holding that key and hasn't been altered since. Anyone can forge a header and payload; only the signature check catches it.
This tool decodes the header and payload for every token, since that requires no key. It also checks the expclaim, if present, against your device's clock to flag whether the token has expired. Signature verification is supported for HS256 tokens when you supply the secret; other algorithms are decoded but not verifiable here.
Common Use Cases
Debugging an authentication failure
Pasting a token straight from a failed request's Authorization header shows immediately whether it expired, has the wrong claims, or is malformed.
Checking what a third-party API actually issued
Decoding a token returned by an OAuth provider or identity service confirms which claims and scopes it actually contains, rather than trusting documentation.
Confirming an HS256 token was signed with the expected secret
During local development, verifying a token against the secret in your own config catches a mismatched signing key before it becomes a production 401.
Reviewing a token before pasting it into a bug report
Decoding a token locally lets you check exactly which claims it carries before deciding whether it's safe to share in a ticket or chat.
Frequently Asked Questions
Is my token sent to a server to be decoded?
No. The header and payload are base64url-encoded, not encrypted, so decoding them is plain string decoding and JSON parsing done entirely in your browser. Nothing is transmitted anywhere.
Can this tool verify any JWT signature?
Signature verification here is limited to HS256 (HMAC-SHA256), the most common symmetric algorithm. Tokens signed with RS256, ES256, or other asymmetric algorithms need the public key, which this tool does not currently support.
Why can I read the payload without a key?
A JWT is encoded, not encrypted. The header and payload are just base64url text; anyone with the token can decode them. The signature is what proves the token was issued by a party holding the signing key, not a way to keep the payload secret.
What does the expiry check tell me?
If the payload has an exp claim (a Unix timestamp in seconds), this tool compares it against your device's current time and flags the token as expired or valid. It doesn't check other time-based claims like nbf (not before).