JWT decoder & verifier
Paste a JSON Web Token to decode its header and payload, read the claims and expiry, and optionally verify an HS256/384/512 signature with your secret — all in your browser, the token never leaves your device.
Frequently asked
Is my token safe to paste here?
Yes — the decoding and signature check happen entirely in your browser via JavaScript and WebCrypto. Neither the token nor the secret is ever sent to a server. That's the point: a JWT payload is readable by anyone, so a token you're debugging should never be uploaded to a random site.
Why can't it verify my RS256 token?
RS256/ES256 use asymmetric keys — verification needs the issuer's public key, not a shared secret, and confirms the signature was made with the matching private key. This tool verifies HMAC (HS256/384/512) where you hold the secret; it still decodes RS/ES tokens so you can read the claims.