JWT Decode Online — Free JWT Decoder & Token Verifier

What is this tool for?

The JWT Decoder & Verifier helps you decode JSON Web Tokens (JWTs), inspect header and payload claims, check expiration, verify HMAC signatures (HS256, HS384, HS512), and encode new tokens — all in your browser. It is a practical jwt.io alternative for OAuth bearer tokens, API debugging, and auth troubleshooting.

JWTs use Base64URL encoding in the header and payload. After decoding, you can format JSON claims with the JSON Formatter, encode binary claim data using the Base64 Encoder/Decoder, or verify related HMAC digests with the HMAC Generator.

How to decode a JWT online

Open the Decode tab and paste your JWT token into the input field.
The header and payload decode automatically — no button click required.
Optionally enter the signing secret to verify HS256/HS384/HS512 signatures.
Review expiration status and standard claim explanations in the results panel.
Copy a shareable link if you need to send the same decoded token to a teammate.

How to encode a JWT online

Switch to the Encode tab.
Edit the header and payload JSON (defaults include alg, typ, sub, exp).
Choose HS256, HS384, or HS512 and enter your signing secret.
Copy the generated token from the output field.

How is this different from jwt.io?

Like jwt.io, this tool decodes JWT header and payload sections and supports HMAC signature verification. It runs entirely client-side, shows clear expiration warnings, and adds a permanent share link for decoded tokens. RS256/ES256 verification requires a public key and is not supported in-browser here — use your backend or a dedicated library for asymmetric algorithms.

Related security & developer tools

Decode and verify tokens with the JWT Decoder & Verifier, encrypt sensitive strings using Encrypt Decrypt, generate keyed digests with the HMAC Generator, or browse all Encoding & Encryption tools and Developer Tools.

Disclaimer

This tool is for educational and debugging purposes. Tokens are processed locally and are not sent to our servers. Avoid pasting production secrets or highly sensitive tokens unless you trust your environment.

Frequently Asked Questions

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It has three dot-separated parts: header, payload, and signature. JWTs are widely used for authentication and authorization in web and mobile applications.

Can I verify JWT signatures online?

Yes. Enter your HMAC signing secret on the Decode tab to verify HS256, HS384, or HS512 signatures. Asymmetric algorithms such as RS256 require a public key and are not verified by this browser tool.

Why does my JWT fail to decode?

Common causes include missing dot separators, invalid Base64URL characters, or malformed JSON in the header or payload. Ensure the token has exactly three parts and was not truncated when copied.

Is my JWT data stored or shared?

No. Decoding and verification happen locally in your browser. We do not store or transmit your tokens or secrets to our servers.

Is it safe to paste production tokens?

Only if you trust the device and browser you are using. Even though processing is local, shared machines, screen recordings, or browser extensions can expose sensitive token data. Prefer test tokens when possible.

Report

JWT Decoder & Verifier