Encoders and decoders
JWT Decoder
Decode a JSON Web Token to read its header and claims, and verify its HMAC signature with your secret.
- Runs in your browser
- Instant results
- Free, no sign-up
Loading the tool…
How to use the JWT Decoder
- Paste the token (a Bearer prefix is fine).
- Read the header, payload and claim dates; expired tokens are flagged.
- Optionally enter the secret to verify an HS256, HS384 or HS512 signature.
Frequently asked questions
Is it safe to paste a production token here?
Decoding and verification run entirely in your browser; nothing is sent to a server. Still, treat live tokens like passwords.
Does decoding prove the token is valid?
No. Anyone can decode a JWT. Only signature verification proves it was issued by someone with the key.
Can I verify RS256 tokens?
Not yet. Verification here supports HMAC algorithms (HS256, HS384, HS512).