JWT Decoder & Verifier

Decode, inspect and verify JSON Web Tokens

Back
100% Private: Decoding and signature verification run entirely in your browser. Your token and secret are never sent to any server.

Encoded Token

Verify Signature (HMAC)

Supports HS256, HS384 and HS512. RS/ES/PS algorithms are decoded but not verified here.

Header 

—

Payload 

—

JWT Decoder Features

  • Instant Decoding: View the header and payload as formatted JSON the moment you paste a token.
  • Expiry Detection: Human-readable exp, iat and nbf with a live valid / expired badge.
  • Signature Verification: Confirm HS256/384/512 signatures with your secret using the Web Crypto API.
  • Privacy First: Nothing is uploaded — all work happens locally in your browser.

Perfect For

  • API Debugging: Inspect auth tokens returned by your login and OAuth flows.
  • Troubleshooting Auth: Check why a token is rejected — expired, wrong secret, or bad claims.
  • Learning JWT: Understand token structure and how signatures protect the payload.
  • Security Reviews: Spot weak algorithms (e.g. alg: none) and missing expiry.