JWT Decoder
Decode and inspect JWT tokens.
Runs in your browserAbout
JWT Decoder splits a pasted JSON Web Token into its header, payload, and signature, decoding the header and payload as readable JSON and flagging standard claims like expiry and issued-at with human-readable dates and an expired/active indicator. It can also verify an HMAC-signed token's signature locally if you provide the secret. The token you paste is never sent anywhere — verification happens entirely in your browser.
Frequently asked
- Does it verify the token's signature, or just decode it?
- Both — decoding the header and payload needs no secret, but if you provide the HMAC secret, it also verifies the signature locally using the Web Crypto API.
- Is my token sent to a server to be decoded?
- No. JWTs often carry sensitive claims, so decoding and verification both happen entirely client-side; the token never leaves your browser.