Decode JWTs, run health checks, and verify HS256/384/512 signatures locally.
Decode any JWT and view the header, payload, and signature, with claim explanations and a token health check (expiry, algorithm safety). Verify HMAC (HS256/384/512) signatures locally by pasting the secret — it never leaves your browser. Pure client-side.
Upload your file using the tool above.
Adjust any settings to your preference.
Click the process button and wait for results.
Download your output using the download button.
Decoding happens entirely in your browser and the token is never transmitted or stored — that is deliberate, because JWTs are credentials. Even so, treat any token you paste anywhere as potentially exposed: prefer expired or test tokens, and if you must decode a live one, rotate it afterwards.
No. Decoding reads the header and payload, which are only Base64-encoded and readable by anyone. Verification is separate — it requires the signing secret or public key to confirm the signature. A token can decode perfectly and still be forged, expired or issued by someone you do not trust.
They are timestamps in Unix seconds. exp is when the token expires, iat when it was issued, and nbf the earliest moment it may be accepted. We show these as readable dates so you can immediately tell whether a token has expired — by far the most common cause of a sudden 401.
Yes, JWT Decoder & Verifier is completely free. No signup, no account, and no watermark on outputs. A Pro tier is available for 100 AI ops/day and larger file sizes.
JWT Decoder & Verifier runs entirely in your browser. Your file is never uploaded — it is read, processed and saved locally, so it never reaches our servers or anyone else's. You can disconnect from the internet after the page loads and it still works.
Sent as Authorization: Bearer eyJ… header with every API request. The server validates the signature before processing.
One JWT from an identity provider (Auth0, Okta, Google) grants access to multiple services without re-logging in.
Services verify the JWT independently without calling a central auth server — enabling stateless, scalable architectures.
Stored in secure storage or HTTP-only cookies. Sent with each API call to identify the user.
Access tokens and ID tokens in OAuth flows are usually JWTs containing user identity and permission scopes.
One-time JWTs with short expiry (15 min) sent in links for email verification and password reset flows.
What is a JWT? A JSON Web Token (RFC 7519) is a compact, URL-safe token with three Base64url-encoded parts: the Header, the Payload (claims), and the Signature (cryptographic proof).
Signed vs encrypted: Standard JWTs are signed — the payload is encoded, not encrypted. Anyone who sees the token can decode and read the claims. The signature only proves authenticity.
Algorithm choice: HS256 uses a shared secret — all parties must know it. RS256 and ES256 use public/private key pairs — services verify using the public key. For new systems, ES256 offers the best balance of security and speed.
Privacy: All decoding runs in your browser using native atob(). The token never leaves your device.