JWT Decoder
Decode JWT tokens, validate structure, inspect claims, and verify HMAC signatures. Free online JWT decoder.
Security Notice: Never paste production tokens or secrets. All processing is local.
JWT Token
Decoded Token
Decoded JWT will appear here...
About this tool
Decodes a JWT's header and payload so you can read the claims without leaving your browser. Optional signature verification covers HS256, HS384, and HS512 when you provide the shared secret.
When you’d use it
- Working out why a token is being rejected: expired, wrong audience, missing claim.
- Confirming what an identity provider or API actually put in a token before writing code around it.
- Verifying an HMAC-signed token when you control the secret.
Frequently asked questions
- Does this verify the signature by default?
- No, decoding and verifying are separate steps: the header and payload appear as soon as you paste a token, and signature verification only runs if you turn it on and supply the secret, so never treat a decoded token as authentic without checking the signature.
- Does it support RS256 or ES256 tokens?
- Not for verification: RSA- and EC-signed (asymmetric) tokens will decode normally, but verification here only covers the HMAC (HS*) family.
- Is it safe to paste a production token here?
- All decoding runs locally and nothing is transmitted, but treat any token as sensitive regardless: don't paste one you wouldn't want visible on your screen or in your clipboard history.
Free developer tools by Clocktower and Associates. All processing happens in your browser: no data is collected or transmitted.