JWT decoder
Decoded in your browser — the token never leaves this page.
Decoded in your browser — the token never leaves this page.
Most JWT tools decode on a server, which means pasting a token hands a live credential to a third party. This page ships the decoder as JavaScript: base64url decoding, claim parsing, and HS256/384/512 verification all run inside your browser via WebCrypto. Open devtools — the network stays silent.
The signature check tells you whether the secret you supplied signed this exact token. It does not validate audience, issuer, or expiry policy — that remains your application's job.
Yes. The token is decoded entirely in your browser — no request leaves the page, nothing is logged or stored. That matters for JWTs specifically, because a pasted token is a live credential on many sites that decode server-side.
A JWT’s header and payload are only base64url-encoded, not encrypted — anyone holding a token can read its claims. The secret (or private key) is needed only to verify or forge the signature.
For HMAC algorithms (HS256/HS384/HS512), yes — paste the shared secret and it is checked locally with WebCrypto. RS/ES/PS tokens are signed with a private key and verified with the matching public key, which this page does not fetch.
Unix-epoch time claims: exp is when the token expires, iat when it was issued, nbf the moment before which it must be rejected. This page converts each to a readable date and flags an expired token.