JWT Decoder
Decode a JWT, check its HS256 signature, or make a test token.
Questions
Where do I enter the secret?
In the Secret field above the panels. It's used in both directions. Decoding works without it, but the token is then reported as not verified. Encoding always needs one.
Why does it say "not verified" instead of "valid"?
Anyone can read a token's header and payload, because they're only Base64url-encoded JSON. Only checking the signature with the secret proves the token is genuine. Mixing up decoding and verifying is a common source of security bugs.
Can it verify RS256 or ES256 tokens?
No. Those are verified with a public key, which this tool doesn't take. It decodes any token, but only verifies HS256, and it tells you when it skipped the check.
Is a token with alg "none" safe?
No. It has no signature at all. Some JWT libraries used to accept such tokens as valid, which was a real, exploited bug. This tool flags them.
How are exp, iat and nbf shown?
As a date in your time zone and a relative time, such as "in 2 hours". An expired token, or one that isn't valid yet, is flagged.
Is my token or secret sent anywhere?
No. Everything runs in your browser with the Web Crypto API. This tool has no Share button, because a link would carry the token.
Related tools
- Base64 Encoder & DecoderEncode text to Base64 or decode it back, with URL-safe and file support.
- SHA-256 Hash GeneratorGet the SHA-256 hash of text or a file, and check it against an expected one.
- SHA-512 Hash GeneratorGet the SHA-512 hash of text or a file, and check it against an expected one.
- HMAC GeneratorSign text with a secret key: HMAC-SHA256, SHA-512, SHA-1 or MD5.