JWT Decoder 🔒 Your data never leaves your browser.
Decode JWT header & payload, check expiration. Nothing is sent anywhere.
The secret never leaves this page and is not saved.
Claim explanations
Header claims
| Claim | Value | Meaning |
|---|
Payload claims
| Claim | Value | Meaning |
|---|
About this tool
A JWT (JSON Web Token) has 3 dot-separated parts: header, payload and signature. The header and payload are just Base64URL-encoded JSON — anyone holding the token can read them, which is why you should never put sensitive data in a JWT payload. This tool decodes the token, checks expiration (exp/nbf) and explains each standard claim.
Unlike many JWT decoders, everything here runs 100% in your browser — your token (which often carries live session credentials) is never sent to any server.
Frequently asked questions
Is a JWT encrypted?
No. A standard JWT is signed, not encrypted — its header and payload are just Base64URL, so anyone can decode and read them without any key. Never put secrets inside a JWT payload.
What does "Signature verified" actually prove?
It proves the token's header and payload haven't been altered since whoever holds the secret (or private key) signed it. It says nothing about whether the claims inside are true — that's a separate authorization decision your backend makes.
Why can this tool only verify HS256/HS384/HS512 tokens?
Those are symmetric algorithms — verifying them just needs the same shared secret used to sign, which you can safely type into this page. RS256/ES256 and similar use a private key that must never leave your server, so this tool can't verify them.
What does it mean when the header says "alg": "none"?
It means the token isn't signed at all — anyone can edit its payload and it will still "decode" successfully. A server that accepts alg: none tokens has a serious vulnerability; this tool flags it with a warning.
Is my token or secret sent to a server when I decode or verify it?
No. Decoding and signature verification both run locally in your browser using the Web Crypto API — the secret you type in is never saved or transmitted.