Is my token sent anywhere?

No. Decoding and signature verification happen entirely in your browser. Nothing is transmitted, logged or stored — which matters, since a live token is a credential.

Does decoding prove the token is valid?

No, and this is the single most common JWT mistake. Decoding just base64url-decodes text that anyone can read or fabricate. Only verifying the signature with the issuer's key tells you the claims are authentic.

Why can't it verify my RS256 token?

RS and ES algorithms sign with a private key and verify with the matching public key, which only the issuer publishes. This tool supports HMAC algorithms, where both sides share one secret.

JWT Decoder

Runs in your browser

Read a JSON Web Token's header and payload, check its expiry, and optionally verify an HS256 signature — all in your browser.

Token

About this tool

A JWT is three base64url segments joined by dots: a header saying how it was signed, a payload of claims, and a signature. The payload is encoded, not encrypted, which surprises people regularly — anyone holding the token can read every claim in it, so it is not a place for secrets. What the signature provides is integrity: proof that the claims have not been altered since the issuer signed them. Decoding tells you what a token says; only verifying tells you whether to believe it.

How to use

Paste a JWT. A leading 'Bearer ' is stripped automatically.
Read the decoded header and payload, and check the expiry status.
To verify an HS256/384/512 signature, enter the shared secret.

When to use this tool

Checking why an API is rejecting a token as expired.
Inspecting which claims and scopes an identity provider issued.
Confirming the algorithm and key id in a token's header.
Verifying that a token was signed with the secret you expect.

Tips

Never put anything sensitive in a JWT payload — it is readable by anyone who has the token.
An `alg` of `none` in a token you received is a red flag, not a convenience.
Expiry is checked against your device clock, so a badly wrong system time will give a misleading result.

Limitations

Decoding is not verification. A JWT payload is encoded, not encrypted — anyone can read it, and a decoded token proves nothing about authenticity.
Signature checking is supported for HS256/384/512 only; RS and ES algorithms need the issuer's public key.

FAQ

Is my token sent anywhere?: No. Decoding and signature verification happen entirely in your browser. Nothing is transmitted, logged or stored — which matters, since a live token is a credential.
Does decoding prove the token is valid?: No, and this is the single most common JWT mistake. Decoding just base64url-decodes text that anyone can read or fabricate. Only verifying the signature with the issuer's key tells you the claims are authentic.
Why can't it verify my RS256 token?: RS and ES algorithms sign with a private key and verify with the matching public key, which only the issuer publishes. This tool supports HMAC algorithms, where both sides share one secret.