JWT Decoder — Decode and Verify Tokens
Decode JWT tokens instantly. View header, payload, and signature. Check expiration and verify signatures. 100% browser-based, nothing sent to servers.
JWT Token
How it works
- A JWT has three Base64URL-encoded parts separated by dots (
header.payload.signature). - The header and payload are decoded and parsed as JSON — they are not encrypted, anyone can read them.
- The signature proves the token was issued by whoever holds the secret key. Without a key you can decode but not verify.
- All decoding runs locally in your browser — your JWT is never sent to any server.
About JWT Decoder
JWT (JSON Web Token) is a compact standard (RFC 7519) for transmitting claims between parties as a signed, URL-safe token. A JWT consists of three parts: the header declares the algorithm, the payload holds the claims (user ID, roles, expiration, etc.), and the signature binds and verifies them. Because the header and payload are merely Base64-encoded (not encrypted), never put sensitive data like passwords inside a JWT — treat it like a wearing a transparent ID badge that anyone can read.
Use this decoder to inspect tokens from Auth0, Firebase, Supabase, or your own service during development and debugging. For production verification with HMAC (HS*) secrets or RSA (RS*) keys, you need the corresponding secret or public key — use it alongside the JWT Generator on this site to create and verify a matching pair.
What a JWT actually contains
A JWT is three base64url segments separated by dots: a header naming the algorithm, a payload carrying the claims, and a signature over the first two. Decoding is not verifying. Anyone can decode a token and read its contents; what requires a secret is confirming the signature was not altered.
Because the payload is only base64url-encoded and not encrypted, treat everything inside as visible to anyone holding the token. Putting a password or a private key in a claim is a common and serious mistake.
Signature verification
For HS256, HS384 and HS512 the signature is an HMAC over the header and payload using a shared secret, computed with the Web Crypto API in this browser. If verification fails with a valid-looking token, the usual causes are a mismatched secret, a token that has expired, or a signing library that produced a non-standard HMAC.
RS256 and ES256 cannot be verified with a shared secret — they need the issuer's public key. The signing tool on this site produces HS-family tokens, which is the right choice for internal services but not for tokens a third party must verify.
Claims worth checking
`exp` and `nbf` are timestamps in seconds since the epoch; an expired token is rejected even with a valid signature. `aud` should match the service receiving the token — a token minted for another service is still validly signed, just not for you. `iss` identifies the issuer and is how you decide which key to verify with.
Next steps
- JWT Generator— create a matching token
Frequently Asked Questions
How do I decode a JWT token?
Can I verify a JWT signature?
Is my data sent to a server?
Do I need an account or API key?
Can I use these tools offline?
All processing happens in your browser. No uploads, no tracking, no servers. Your API keys, configs, and private payloads stay private — 100% client-side.