JWT Decoder
Paste any JSON Web Token to decode its header and payload, inspect standard claims, check expiry, and optionally verify the signature. Everything runs in your browser — your token never leaves your device.
JWT Token
Header
—Payload
—Signature
Nothing is sent to our servers. All decoding and verification happens entirely in your browser.
Verify Signature
Signature verification is supported for HS256 tokens only. Enter the HMAC secret used to sign this token.
How to use this tool
- Paste your JWT into the text area at the top — it will be decoded instantly as you type.
- Inspect the Header panel to see the signing algorithm and token type.
- Read the Payload panel to view all claims. If the token has an 'exp' field, an expiry badge shows whether it is still valid.
- To verify an HS256 signature, enter your secret in the Verify Signature section and click Verify.
- Use the Copy button on each panel to copy the decoded JSON to your clipboard.
Why use our JWT Decoder?
Debugging JWT authentication is a common developer task, but pasting tokens into third-party sites carries risk. This decoder runs entirely in your browser — no token data is ever transmitted. Use it safely for production tokens during local development, API debugging, or security reviews.
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit information between parties. It consists of three base64url-encoded sections separated by dots: a Header (algorithm and type), a Payload (claims such as user ID, roles, and expiry time), and a Signature used to verify the token's authenticity.
Are JWTs encrypted?
Not by default. Standard JWTs (JWS — JSON Web Signature) are signed but not encrypted, which means the header and payload are readable by anyone who holds the token. They are encoded in base64url, not encrypted. If you need confidentiality, use JWE (JSON Web Encryption) instead. Never put sensitive secrets — passwords, credit card numbers — in a plain JWT payload.
What does 'alg: none' mean and why is it dangerous?
The 'alg: none' value in a JWT header means the token carries no signature at all. Some servers have historically accepted such tokens as valid, allowing attackers to forge arbitrary payloads. This is a well-known vulnerability (CVE-2015-9235). A correctly implemented server should always reject tokens with 'alg: none'.
How do I verify a JWT signature with this tool?
For HS256 tokens, enter the HMAC secret in the Verify Signature section and click Verify. The tool recomputes the expected signature client-side and compares it to the one in the token. RS256 and other asymmetric algorithms are not yet supported for verification — you will need a server-side library for those.
What are the most common JWT claims?
'iss' (issuer) identifies who issued the token. 'sub' (subject) identifies the principal — often a user ID. 'exp' (expiration time) is a Unix timestamp after which the token must be rejected. 'iat' (issued at) records when the token was created. 'nbf' (not before) sets the earliest time the token is valid. 'aud' (audience) identifies the intended recipients.
Related Tools
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes from text or files in your browser.
Base64 Encoder / Decoder
Encode and decode Base64 text quickly and easily.
Cron Expression Builder
Build, test, and understand cron expressions with a visual builder and next run times.
JSON Formatter
Format and validate JSON instantly for development and debugging.
Recently Visited Tools
Cron Expression Builder
DeveloperBuild, test, and understand cron expressions with a visual builder and next run times.
CSS Gradient Generator
DeveloperCreate linear, radial and conic CSS gradients with a live visual editor. Copy the CSS code instantly.
Regex Tester
DeveloperTest and debug regular expressions with real-time match highlighting, group capture, and substitution.