JWT Decoder & Verifier
Decode, verify, and generate JSON Web Tokens instantly in your browser — 100% client-side, nothing leaves your device.
What is the JWT Decoder & Verifier?
JSON Web Tokens (JWT) are the industry-standard mechanism for securely transmitting claims between services. A JWT consists of three Base64URL-encoded segments — a header declaring the signing algorithm, a payload containing claims like user identity and expiration, and a cryptographic signature that guarantees integrity. Because the payload is only encoded and not encrypted, anyone can read it — but only a party holding the secret key can produce a valid signature. This tool lets you decode headers and payloads instantly, verify HMAC-SHA256 signatures client-side, inspect expiration claims in real time, and generate test tokens for development — all without transmitting a single byte to any server.
How to use the JWT Decoder & Verifier?
- Choose your mode from the tabs: 'Decode Token' to inspect an existing JWT, or 'Generate Test Token' to create a new signed JWT for testing.
- Paste your encoded JWT (header.payload.signature) into the input area. The tool instantly color-codes the three segments — header (red), payload (purple), and signature (blue) — for visual clarity.
- Inspect the decoded Header JSON to confirm the signing algorithm (e.g., HS256) and token type. Review the Payload JSON to see all claims including sub, iat, exp, and custom fields.
- Check the Expiry Status indicator below the payload. It automatically calculates whether the token is still active or has expired, with a human-readable countdown timer.
- To verify signature integrity, enter your HMAC-SHA256 secret key and click 'Verify Signature'. The tool computes the expected signature locally and compares it — no data leaves your browser.
- Use the 'Share URL' button to generate a shareable link containing the token as a query parameter. Recipients can instantly decode the token by opening the link.
- Switch to 'Generate Test Token' to create custom JWTs. Configure the header, payload claims, and secret key, then click 'Generate Token' to produce a valid HS256-signed JWT.
Frequently Asked Questions
Is this JWT decoder safe for production tokens?
Yes, runs entirely in browser. Token never leaves your device. Safe for access tokens, refresh tokens, and any auth credentials.
What is a JWT?
JSON Web Token — a compact, URL-safe token format (header.payload.signature) used for authentication and information exchange between parties.
What does JWT verification do?
Recomputes the HMAC-SHA256 signature using your secret key and compares it against the token's signature segment. Confirms the token hasn't been tampered with.
Can I decode a JWT without the secret key?
Yes, the header and payload are only Base64URL-encoded, not encrypted. Anyone can decode them. The secret is only needed to verify the signature.
What's the difference between encoding and encryption in JWT?
JWT payloads are encoded (Base64URL), not encrypted. Anyone can read the payload. Use JWE (JSON Web Encryption) if you need payload confidentiality.
How do I generate a test JWT?
Enter a JSON header, JSON payload, and a secret key. Click Generate Token to produce a valid HS256-signed JWT for testing purposes.
JWT Decoder Features
Instant Token Decoding
Paste any JWT and instantly see the decoded header and payload JSON. The tool automatically splits and color-codes the three token segments — header (red), payload (purple), signature (blue) — for visual clarity.
Header & Payload Inspection
View the signing algorithm (alg), token type (typ), and all payload claims including sub, iat, exp, iss, aud, and any custom fields — formatted as readable, pretty-printed JSON.
HMAC-SHA256 Signature Verification
Enter your secret key to verify token integrity locally. The tool computes the expected HMAC-SHA256 signature using the Web Crypto API and compares it to the token's signature segment — entirely client-side.
Token Generation
Create custom HS256-signed JWTs for testing and development. Configure header, payload claims (sub, name, exp, iat), and secret key to produce valid tokens without writing any code.
Expiration Countdown
The tool reads the exp claim, converts the Unix timestamp to a human-readable date, and displays a real-time indicator showing whether the token is still active or has expired.
100% Private & Client-Side
No data is sent to any server. All decoding, verification, and generation happens in your browser using JavaScript and the Web Crypto API. Safe for production tokens and sensitive credentials.
Related Developer Tools
Working with JWTs? These tools on InstantToolsHub pair well with the decoder: