Home / JWT Decoder
JWT Decoder
Paste a JWT to see its header and payload, check whether it's expired, and verify its signature against a secret, all decoded locally in your browser.
JWT decoder tool
How this tool works
A JWT has three Base64url-encoded parts separated by dots: header, payload, and signature. The header and payload are not encrypted, just encoded, so this tool can decode and display them instantly with no secret required. Verifying the signature is a separate step: if you provide a secret, the tool recomputes an HMAC signature over the header and payload using the Web Crypto API's crypto.subtle.sign() and checks whether it matches the token's actual signature. This tool currently verifies HMAC-signed tokens (HS256, HS384, HS512). RSA/ECDSA-signed tokens (RS256, ES256, etc.) can still be decoded, but verifying those requires the issuer's public key rather than a shared secret.
- IETF RFC 7519, JSON Web Token (JWT)
- MDN Web Docs, SubtleCrypto: sign() method, developer.mozilla.org
Frequently asked questions
Is it safe to paste my JWT into this decoder?
Decoding is always safe. A JWT's header and payload are just Base64url-encoded JSON, not encrypted, so anyone can read them without a secret. This tool decodes entirely in your browser and never sends the token anywhere. That said, avoid pasting tokens containing real production secrets or sensitive user data into any web page, including this one, as a general precaution.
Why does it say "Invalid Signature" even though the token looks right?
The two most common causes: the secret you entered doesn't match the one used to sign the token (check for typos, extra spaces, or the wrong environment's secret), or the token was modified after signing. Even changing one character in the payload invalidates the signature.
Need to build a token instead of decoding one?
Use the JWT Builder on the main generator to create and sign a new HS256 token.