🔑 Developer Tools

JWT Decoder

Decode a JSON Web Token to read its header and claims — and verify an HS256 signature, all in your browser.

Header · HS256

Payload

Claims

sub1234567890
nameAda Lovelace
iat1716239022Issued at: 5/20/2024, 9:03:42 PM
exp2000000000Expires: 5/18/2033, 3:33:20 AM · ✓ valid

Verify signature (HS256)

Overview

JWT Decoder: read and verify any JSON Web Token

A JSON Web Token (JWT) looks like an unreadable string of three dot-separated chunks, but it is really just Base64URL-encoded JSON that anyone can read. This decoder splits a token apart and shows you the header, the payload and every claim in plain JSON, with the timestamp claims (issued-at, expiry, not-before) translated into readable dates and an at-a-glance expired/valid check.

Crucially, it does all of this — including optional HS256 signature verification against your secret — entirely in your browser using the Web Crypto API. Your token and secret are never sent to a server, which matters because a JWT is often a live credential. Paste, read, and verify without any of it leaving your device.

100% freeNo sign-upVerifies locallyRuns in your browser
How to use it
  1. 1Paste your JWT into the box (or load the sample).
  2. 2Read the decoded header and payload; check the claims table for expiry and timing.
  3. 3To verify an HS256 token, enter the signing secret and press Verify.
  4. 4A green tick means the signature matches that secret; a red cross means it does not.
Key features
  • Decodes the header and payload of any JWT to readable JSON
  • Translates exp, iat and nbf into local dates with an expiry check
  • Optional HS256 signature verification via the Web Crypto API
  • Highlights the algorithm and lists every claim
  • Clear errors for malformed tokens
  • 100% client-side — your token and secret never leave your device

Frequently asked questions

Is it safe to paste a JWT here?
Yes. Decoding and verification happen entirely in your browser with JavaScript and the Web Crypto API — nothing is uploaded, logged, or stored. That said, treat production tokens carefully anywhere.
Does decoding a JWT verify it?
No. Anyone can decode a JWT because the payload is only Base64-encoded, not encrypted. Verification checks the signature against a secret or key, which is a separate step — use the Verify box for HS256 tokens.
Why can't I verify RS256 tokens?
RS256 uses a public/private key pair rather than a shared secret. This tool verifies HS256 (shared-secret) tokens; for RS256 you would paste the public key, which is a heavier flow.
What does 'exp' mean?
The exp claim is the expiry time as a Unix timestamp. After that moment the token should be rejected. The claims table converts it to a readable date and flags whether it has expired.
📖

Full guide

JSON Web Tokens Explained — Structure, Claims & Security

What a JWT is made of, how signing and verification work, the difference between HS256 and RS256, and common pitfalls.

Header, payload & signatureSigning vs encryptionCommon JWT mistakes

Related Articles & Guides

BlogWebsite Down or Just Me? How to Check in 30 SecondsA site will not load. Before you clear your cache, reboot the router, or file an angry support ticket, answer one question: is the site down for everyone, or juArticleJSON Web Tokens Explained: Structure, Claims & SecurityWhat a JWT is made of, how signing and verification work, the difference between HS256 and RS256, and the security mistakes to avoid.BlogMD5 vs SHA-256: Which Hash Should You Actually Use?MD5 and SHA 256 both turn any input into a fixed length fingerprint — but treating them as interchangeable is one of the most common security mistakes in softwa