JWT Decoder & Debugger Online — Free & Private
Paste a JSON Web Token to see its header and claims decoded, check whether it is expired, and — if you paste the secret — verify the HS256 signature.
- Decoding never proves a token is valid — always verify the signature before trusting claims.
- Paste the secret to run an HS256 signature check; nothing is sent to a server.
- Watch the exp row: expired tokens fail auth even when the signature is perfect.
A real JWT plus its secret is effectively a live session. Decoding and HS256 verification run entirely in your browser — the token and secret are never uploaded, stored, or logged.
Reading a decoded token
A JWT is three base64url segments joined by dots: header.payload.signature. The header names the algorithm (HS256, RS256…); the payload carries the claims. iss identifies who issued the token, sub the subject it is about, aud who it is for, exp when it dies, iat when it was born, nbf the earliest it counts.
None of that is hidden — base64 is an encoding, not encryption. Anything in the payload (user IDs, roles, emails) is readable by anyone holding the token. That is by design, but it means you must never put a secret in a JWT payload.
Signature verification, the honest way
The alg: none trick — a token that claims to have no signature at all — broke real systems, which is why verifying libraries should never trust the header's algorithm blindly. This tool verifies HS256 only: paste the shared secret and it recomputes the HMAC over the exact signing input and compares it to the third segment.
A matching signature proves the token was issued by someone holding the secret and has not been modified since. It does not prove the token has not expired (check exp), that it was meant for your service (check aud), or that it came from the issuer you expect (check iss).
Private debugging
Tokens pasted into online JWT decoders often contain real sessions — valid credentials for someone's account. This tool decodes and verifies in your browser only; the token and secret are never uploaded, stored, or logged.
Frequently asked questions
Does decoding a JWT mean it is valid?
No. Decoding just un-base64s the segments — any string with two dots can be decoded. A token is trustworthy only when the signature verifies (right secret), it is unexpired (exp), and it matches your issuer/audience expectations.
Can this tool verify RS256 tokens?
Not yet — verification currently supports HS256 with a shared secret, which covers the most common case. RS256 needs the public key in JWK or PEM form and is a planned addition.
Is my token or secret uploaded?
No. Decoding and HS256 verification run entirely in your browser. A real token plus its secret is effectively a live session, so it never leaves your device.