JWT Decoder
Decode a JWT to read its header and payload, check expiry, and verify HS256/384/512 signatures. Your token stays in your browser. Free.
Ad space · responsive
How to use JWT Decoder
- Paste a JWT — with or without “Bearer”.
- Read the header, payload and expiry in plain language.
- Optionally enter the HMAC secret to check the signature.
Privacy
Runs entirely in your browser. Nothing you enter or open here is uploaded.
Questions
Is decoding the same as verifying?
No. Anyone can decode a JWT; only checking the signature proves it wasn't changed. This page can verify HS256/384/512 with a shared secret.
Is my token sent anywhere?
No. Decoding and verification run in your browser.