JWT Decoder

Paste a JSON Web Token to read its header, payload and claims — and check the signature. The token never leaves your browser.

Encoded token

Decoded locally in your browser — the token is never sent anywhere.

Header

Payload

Signature

Secret (HMAC) Secret is base64-encoded

The secret or key is used only in your browser (Web Crypto) and is never sent anywhere. Decoding still shows the contents whether or not the signature checks out.

Free JWT Decoder — read a JSON Web Token's header & payload, in your browser

Paste a JWT and instantly see its decoded header and payload, the standard claims in plain language, and whether it has expired. Decoding happens entirely in your browser — the token is never uploaded — so it is safe to inspect tokens while you debug.

Decode here, verify here — nothing leaves your browser

A JWT's header and payload are just base64url-encoded JSON, so anyone can read them — this tool decodes them for you. You can also verify the signature right here: paste the HMAC secret or the public key and it is checked locally with the Web Crypto API, never uploaded. Decoding alone shows the contents; only a verified signature proves the token is authentic.

What you get

Header & payload — pretty-printed decoded JSON.

Readable claims — exp, iat, nbf shown as real dates.

Expiry check — a clear valid / expired badge.

Copy — copy the decoded header or payload JSON.

Verify signatures — check HS, RS, ES and PS tokens locally with your secret or key.

Private — everything runs locally, nothing is uploaded.

No signup, free — client-side, light & dark themes.

Frequently asked questions

Is my token sent to a server?

No. The token is decoded entirely in your browser with JavaScript. Nothing you paste is uploaded or logged anywhere.

Does it verify the signature?

Yes. Paste the HMAC secret (HS256/384/512) or the PEM public key (RS, PS and ES algorithms) and the signature is verified locally in your browser with the Web Crypto API. Your secret or key is never sent anywhere. Decoding the header and payload still works without a key.

Which signing algorithms can it verify?

HMAC (HS256, HS384, HS512) with a shared secret, and RSA and elliptic-curve signatures (RS256/384/512, PS256/384/512, ES256/384/512) with a PEM public key. All verification runs in your browser via the Web Crypto API.

What is a JWT?

A JSON Web Token is three base64url parts — header, payload and signature — separated by dots. The header and payload are just encoded JSON, so anyone can read them; only the signature proves the token was not tampered with.

Is it free and without signup?

Yes, completely free with no signup. It is a client-side JWT decoder for developers and students.