JWT Decoder
dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PDO0hEc5cCPA
Verify signature
A JSON Web Token (JWT) is made of three Base64URL-encoded parts — a header, a payload, and a signature — separated by dots. Paste a token to instantly see its decoded header and payload, an expiry countdown based on the 'exp' claim, and optionally verify an HMAC (HS256/384/512) signature against a shared secret. Everything is decoded locally in your browser; your token is never sent anywhere.
Frequently asked questions
Is my token or secret sent to a server?
No. Decoding and signature verification both happen entirely client-side using the browser's built-in Web Crypto API — nothing leaves your browser.
Why can't I verify some tokens?
Signature verification here only supports HMAC-based algorithms (HS256, HS384, HS512), which use a shared secret. Tokens signed with RS256/ES256 and similar use asymmetric key pairs and require the issuer's public key, which this tool doesn't handle.
What does the expiry badge mean?
It reads the standard 'exp' claim (a Unix timestamp in seconds) from the payload and shows a live countdown to expiry, or how long ago the token expired if it already has.