JWT Decoder & Verifier
Decode JSON Web Tokens, inspect header and claims, check expiry and verify HMAC signatures locally.
About the JWT Decoder & Verifier
A JSON Web Token carries a header, claims and a signature. The JWT Decoder shows each part, explains standard claims and expiry times, and verifies HMAC signatures locally with your secret.
Everything runs in your browser, so your input is never uploaded to a server.
How to use the JWT Decoder & Verifier
- Paste the token (three Base64URL parts separated by dots).
- Read the decoded header and payload, including human-readable expiry.
- Enter the secret to verify an HS256, HS384 or HS512 signature.
Frequently asked questions
Is it safe to paste a production token?
Decoding and verification happen entirely in your browser; nothing is sent to a server. Still, treat valid tokens like passwords and prefer expired or test tokens.
Why can anyone read my token?
JWT payloads are only encoded, not encrypted. Never put secrets in them; the signature only proves they were not modified.
Related tools
Base64 Encode / Decode
Encode text to Base64 or decode Base64 to text with full UTF-8 and URL-safe support.
URL Encode / Decode
Percent-encode or decode URLs and query string components.
HTML Entity Encode / Decode
Escape special characters as HTML entities or decode entities back to text.
JWT Generator
Create signed JSON Web Tokens with HS256, HS384 or HS512 from a custom header and payload.
Unicode Escape / Unescape
Convert text to \uXXXX escape sequences and back, including emoji and astral characters.
JSON Formatter
Format and beautify JSON with configurable indentation and optional key sorting. Errors are reported with exact line and column.