JWT Decoder and Verifier
Decode JSON Web Tokens (JWT). View header and payload. Verify HS256 signatures with secret key.
How to use this tool
- Paste JWT token into input field
- View decoded header (algorithm, type)
- View decoded payload (claims, data)
- For HS256 tokens: optionally enter secret key to verify signature
- Check signature validity status
- Copy decoded header/payload as JSON
About JWT Decoder
JSON Web Tokens (JWT) are compact, URL-safe tokens used for authentication and information exchange. A JWT contains three Base64-encoded parts separated by dots: header (algorithm + type), payload (claims/data), signature (verification).
This decoder parses JWTs to display header and payload in readable JSON. It can verify HS256 (HMAC with SHA-256) signatures if you provide the secret key. Other algorithms (RS256, ES256) require public keys not supported in basic browser tools.
Decoding happens locally. Tokens and secrets stay in your browser, important for debugging production tokens or analyzing authentication without exposing credentials to third parties. Note: JWT decode is not decrypt, payloads are readable by anyone (don't put secrets in JWTs).