JWT Decoder & Verifier
Decode JWT claims and verify signatures — entirely in your browser, nothing uploaded.
100% in your browser — files never leave your device
How JWT decoding and verification work
A JWT is three Base64URL segments — header, payload, signature — joined by dots. Decoding just reverses that encoding and parses the resulting JSON; no cryptography is involved. This tool also reads the standard iat, nbf, and exp claims and tells you whether the token is currently valid, expired, or not yet active.
Verification is a separate, optional step that actually checks the signature using the Web Crypto API — HMAC for HS256/384/512 with a shared secret, or RSASSA-PKCS1-v1_5 for RS256/384/512 with a public key in PEM format. Everything runs locally: your secret or key never leaves the browser.
Decoding requires no secret at all — that's by design. JWTs are signed, not encrypted, so anyone can read the payload of a token they intercept. Never put anything in a JWT payload that you wouldn't be comfortable showing to whoever holds the token.
Frequently asked questions
Is my token sent to a server?
No. Decoding and verification both run entirely in your browser using the native Web Crypto API. Your token never leaves your machine.
Which algorithms does signature verification support?
HS256, HS384, HS512 (HMAC — use the shared secret string) and RS256, RS384, RS512 (RSA — paste the PEM public key starting with -----BEGIN PUBLIC KEY-----). Other algorithms report "unsupported."
Why does decoding work without a secret?
JWT header and payload are Base64URL-encoded, not encrypted. Anyone with the token can read the claims. Decoding is not the same as verification — you still need the secret or public key to confirm the signature is legitimate.