JWT Decoder & Verifier

A free, private JWT decoder and verifier — header/payload/signature viewer, claims analysis, and HMAC signature verification, entirely in your browser.

Initializing JWT Studio...

JWT Studio

How to Use the JWT Decoder & Verifier

Paste any JSON Web Token to see its decoded header and payload, analyzed claims with human-readable timestamps and warnings, and optionally verify its HMAC signature against a secret you supply — entirely in your browser via the Web Crypto API.

  1. 01

    Paste a Token

    Paste any JWT, or click "Load Example" to see a real, correctly-signed example token.

  2. 02

    Read the Header, Payload & Claims

    See the decoded header and payload as formatted JSON, plus a claims table with human-readable expiration/issued-at/not-before analysis and warnings for expired or unusual tokens.

  3. 03

    Verify the Signature (Optional)

    Choose the algorithm you expect (HS256/384/512) and enter the secret key to check whether the signature is valid — this never trusts the token’s own declared algorithm.

Frequently Asked Questions

Answers about this tool.

Is my JWT uploaded to a server?

No. Decoding and verification both run entirely inside your browser using the Web Crypto API. Your token is never sent anywhere.

Does decoding a JWT prove it is valid or trustworthy?

No. Decoding only reveals the header and payload — it does not verify the signature. A token can be decoded and read even if it has been tampered with or was never signed at all.

Can this tool verify RS256/ES256 (RSA/ECDSA) tokens?

Not yet — this baseline supports HMAC-signed tokens (HS256/384/512) only. Asymmetric algorithm support is a planned follow-on, since it requires careful PEM/JWK key-format parsing to do correctly.

Related tools

🍪 We value your privacy

We use strictly necessary cookies to run this site (login, billing). With your consent, we'd also like to use cookies to serve personalized ads and analyze our traffic. Declining only turns off those optional cookies. Read more in our Privacy Policy.