Why this tool stays in the browser
Decode a JSON Web Token in the browser to inspect algorithm, claims, and expiry without posting the token to a third-party debugger. Use it when you need to see iss/sub/aud or catch an expired exp claim during local debugging. Signature verification still needs the secret; this tool does not send the token anywhere to obtain one. Generate a sample JWT next door, or hash a secret separately if you are checking integrity by hand.
Related: JWT Generator · Hash Generator
FAQ
- Is it safe to paste a production JWT here?
- The token is decoded in the browser and is not posted to this server. Treat bearer tokens as secrets anyway — prefer fixtures when you can.
- Does this verify the signature?
- No. It inspects header and payload. Verification needs the signing secret or public key, which this page never asks you to upload.
- What about expired tokens?
- Read the exp claim locally. An expired token still decodes; expiry is a claim, not a network check.
JWT Decoder & Debugger
Decode JSON Web Tokens offline to securely view headers, payloads, and verify signatures. All processing happens in your browser—no data leaves your device.
Supports HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512 algorithms
Paste a JWT token
Enter a JWT token to decode its header, payload, and verify its signature