JWT Decoder

JWT Decoder and Verifier

Decode JSON Web Tokens (JWT). View header and payload. Verify HS256 signatures with secret key.


    
Privacy: Processing happens in your browser. Files and text are not uploaded to Anwita Digital servers.

How to use this tool

  1. Paste JWT token into input field
  2. View decoded header (algorithm, type)
  3. View decoded payload (claims, data)
  4. For HS256 tokens: optionally enter secret key to verify signature
  5. Check signature validity status
  6. Copy decoded header/payload as JSON

About JWT Decoder

JSON Web Tokens (JWT) are compact, URL-safe tokens used for authentication and information exchange. A JWT contains three Base64-encoded parts separated by dots: header (algorithm + type), payload (claims/data), signature (verification).

This decoder parses JWTs to display header and payload in readable JSON. It can verify HS256 (HMAC with SHA-256) signatures if you provide the secret key. Other algorithms (RS256, ES256) require public keys not supported in basic browser tools.

Decoding happens locally. Tokens and secrets stay in your browser, important for debugging production tokens or analyzing authentication without exposing credentials to third parties. Note: JWT decode is not decrypt, payloads are readable by anyone (don't put secrets in JWTs).

Frequently asked questions

The tool can verify HS256 (symmetric) signatures if you provide the secret. RS256/ES256 (asymmetric) verification requires the public key, which basic browser tools typically don't support. Use server-side libraries for full verification.

Standard JWTs are signed, not encrypted, anyone can decode and read the payload. Don't put sensitive data (passwords, SSNs) in JWTs. Use JWE (JSON Web Encryption) if you need encrypted tokens.

Format: header.payload.signature. Header specifies algorithm. Payload contains claims (user ID, expiration, etc.). Signature proves token wasn't tampered with. All three are Base64url-encoded.