Free JWT Decoder

Decode JWT header, payload, and claims locally — with optional HMAC signature verification. Nothing leaves your browser.

The JWT decoder reads the JSON Web Tokens your APIs issue and consume — the compact header.payload.signature form used by OAuth 2.0, OpenID Connect, and countless auth libraries — and renders them as readable, pretty-printed JSON: the header with its algorithm and key id, the payload with its claims, and the raw signature segment. The decode happens entirely in your browser: base64url-decoding and JSON parsing are local, so the tool is safe to use with production tokens that carry real user identifiers, emails, and session details — nothing is uploaded, logged, or stored. What this decoder will not do is overclaim. It can verify an HMAC signature when you paste the secret: the tool computes the HMAC with WebCrypto and reports Signature valid or Signature invalid, so you can confirm a token was actually signed with the secret you hold and has not been tampered with in transit. That check is honest about its scope: only HS256, HS384, and HS512 can be verified with a shared secret in the browser. Asymmetric tokens — RS256, ES256, PS256 and their siblings — are the norm in production, and verifying them requires the signer's public key, which a client-side tool cannot obtain for you; the decoder says exactly that instead of guessing. Tokens with alg=none, the famously unsafe configuration, are flagged as unsecured with no signature. Expiry and issue-time claims (exp, iat, nbf) appear in their raw epoch form inside the payload JSON, exactly as the token carries them — the tool does not convert or interpret, because silent conversion is where decoders lie. Paste a token from your logs, your network inspector, or your tests and read it as the server would.

Processed locally in your browser