JWT Decoder
Decode JWT headers and payloads, and verify HMAC signatures with a secret.
Decoded and verified entirely in your browser using the Web Crypto API. Your token and secret are never sent anywhere.
- Free — no signup, no account, no watermark
- Runs entirely in your browser — nothing is uploaded to a server
- Works on mobile, tablet and desktop
- Instant — results appear as soon as you enter your input
Why this is private
- Decoded and verified entirely in your browser using the Web Crypto API. Your token and secret are never sent anywhere.
- Open your browser's DevTools → Network tab while using this tool — you won't see a request carrying your input, because it never leaves your device.
- Nothing you enter is uploaded to a server or shared with us — the processing happens entirely on your device.
Overview
Decodes a JSON Web Token's header and payload so you can inspect its claims, and — for HMAC-signed tokens (HS256/HS384/HS512) — verify the signature locally against a secret you provide, the same local Web Crypto computation this site's own HMAC Generator uses.
How to use it
- 1Paste a JWT (three base64url segments separated by dots).
- 2The header and payload are decoded and shown as formatted JSON.
- 3Expiry (exp) and issued-at (iat) claims are converted to readable dates.
- 4To verify it's genuine, paste the signing secret into the Verify signature field.
Tips
- Signature verification only works for HMAC-signed tokens (HS256/HS384/HS512), since that's the one JWT signing scheme that uses a shared secret rather than a public/private key pair. RS/ES/PS-signed tokens need the issuer's public key to verify, which this tool doesn't ask for.
Frequently asked questions
What people use it for
Check why an API call returns 401Decode the token you're sending to see whether exp has passed or the scopes/roles claim is missing what the endpoint needs.
Confirm a token wasn't tampered withPaste your signing secret to verify an HS256/384/512 token's signature actually matches, instead of just trusting its claims.
Debug a signature-mismatch errorVerify locally with the secret your server uses to see immediately whether the token or the secret is the problem.
Inspect what a login returnsSee exactly which claims your auth provider puts in the token — sub, email, roles, tenant — while wiring up a new integration.
Confirm an expiry during debuggingThe exp and iat claims are shown as readable dates so you can tell at a glance if a token is stale.
Related guides
- How to read JSON with a tree viewerA tree viewer turns a wall of brackets into a structure you can expand, search and copy paths from. Here's how to use one effectively.
- JSON parse errors explained: 'Unexpected token', 'Expected comma or brace', and the restWhat each common JSON error message actually means, the usual cause, and how to find the spot fast using line and column.
- How to format JSON (and actually understand the errors)JSON looks like a JavaScript object but follows stricter rules. Here's what those rules are and how to read the errors when they're broken.
Related tools
All security toolsHMAC GeneratorGenerate an HMAC signature for a message with a secret key.Base64 DecoderDecode Base64 strings back to text, images or files — including JWTs and data URIs.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes, in hex or Base64, with a compare mode.Unix Timestamp ConverterConvert between Unix timestamps and human-readable dates.
Ready to use JWT Decoder?
JWT Decoder