JWT Decoder & Verifier
Paste a JSON Web Token to decode its header, payload and claims instantly — and check its expiry. Optionally verify an HS256 signature with your secret.
🔒 100% in your browser — your token is never uploadedHeader will appear here…
Payload will appear here…
Signature…
Verify signature (HS256)
RS256/ES256 (asymmetric) verification needs the public key and isn't supported here — this tool verifies HS256 only. The signature is never sent anywhere.
Related: Smart Paste Detector · Base64 Encoder/Decoder · Exposed Secrets Scanner · HTTP Status Codes
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties — most often used for authentication and authorization. It has three Base64url-encoded parts separated by dots: header.payload.signature.
- Header — the token type and the signing algorithm (
alg), e.g. HS256 or RS256. - Payload — the claims. Standard ones include
sub(subject),iss(issuer),aud(audience),exp(expiry),iat(issued at) andnbf(not before). - Signature — proves the token wasn't tampered with. With HS256 it's an HMAC of the header and payload using a shared secret; with RS256/ES256 it's signed with a private key and checked with the public key.
Security note: the payload is only encoded, not encrypted — anyone can read it. Never put secrets in a JWT payload. Decoding a token does not verify it; always verify the signature server-side before trusting its claims.