Paste a JSON Web Token to instantly decode its header, payload, and expiry date. Optionally verify HS256 signatures with your secret — 100% client-side, so your tokens never leave your browser.
JWT Decoder — Decode & Inspect JSON Web Tokens
Paste any JSON Web Token to instantly see its header, payload and expiry — and verify HS256 signatures with your own secret. 100% client-side: your tokens never leave this browser tab.
Expiry
Header
Payload
Verify HS256 signature
Enter the secret the token was signed with. The signature is checked locally with the WebCrypto API — the secret never leaves your browser.
Decoding and signature checks run entirely in your browser. Tokens are never sent to any server.
Paste and decode instantly — no account, no API key, no tracking.
Unlimited decodes and verifications, for as many tokens as you like.
How to decode a JWT
- 1Paste your token
Copy the full token — all three dot-separated parts — into the box above. Decoding starts automatically as you type.
- 2Read the header & payload
The header shows the signing algorithm; the payload shows the claims (user id, roles, issued-at time and more).
- 3Check the expiry
The expiry panel converts the
expclaim into a human date and tells you exactly how long until it expires — or how long ago it expired. - 4Verify the signature
Enter the HS256 signing secret and hit Verify to confirm the token is authentic and untampered.
Why use this JWT decoder
No submit button needed — the token is decoded live as you paste, with malformed tokens flagged immediately.
exp, iat and nbf timestamps become plain dates plus a live countdown like “expires in 1d 3h 22m”.
Signature checks use the browser’s WebCrypto API — the same standard your backend uses — not a toy reimplementation.
Missing parts, broken Base64url and invalid JSON are each reported with a specific, actionable error message.
Learning JWTs? One click loads a valid sample token (secret: demo-secret-123) so you can experiment safely.
Because nothing is uploaded, you can safely inspect production tokens and paste real signing secrets without exposure.
Frequently asked questions
What are the three parts of a JWT?
header.payload.signature, dot-separated. The header names the algorithm (e.g. HS256) and token type; the payload carries the claims (user id, expiry, roles); the signature is a cryptographic hash of the first two parts made with a secret key, proving the token has not been altered.Is a JWT encrypted? Can anyone read my token?
How does HS256 signature verification work?
header.payload using your secret key. This tool recomputes that value locally with the WebCrypto API and compares it to the token’s signature — a match means the token is authentic and untampered.Why does verification say “invalid signature”?
What does “exp” mean, and what if it is missing?
exp is the expiration time as a Unix timestamp. If it is missing, the token technically never expires — the expiry panel will say so. Well-designed APIs always set exp to limit how long a stolen token stays useful.Do you store or log my tokens?
What is Base64url and why does JWT use it?
- and _ instead of + and /, with padding removed) so tokens can travel safely in URLs and HTTP headers without extra encoding.Which algorithms can this tool verify?
Related tools
Encode and decode standard and URL-safe Base64.
Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes.
Unix Timestamp ConverterConvert between Unix time and readable dates.
URL Encoder / DecoderPercent-encode URLs and decode them safely.
QR Code GeneratorCreate QR codes for links, text and Wi-Fi.