KitJade
Developer ToolsRuns in your browser

JWT Decoder

Read JWT claims and optionally verify HMAC signatures.

Use the JWT Decoder tool

Runs in your browserUpdated Report a problem

What this jwt decoder does

JWT Decoder splits a JSON Web Token into its three Base64URL segments and shows the header and payload as formatted JSON. It also converts timestamp claims such as exp, iat and nbf into readable dates and warns when a token is expired.

Decoding is not verification. A JWT is just signed data; anyone can create one. If you paste an HMAC secret, this tool verifies HS256, HS384 or HS512 signatures using Web Crypto in your browser. RS256 and ES256 signatures need the issuer's public key and are not verified here.

Why use it

  • Check which scopes, roles and tenant a token carries before debugging authorization.
  • Spot an expired token in seconds instead of guessing why requests return 401.
  • Confirm that a signature matches a shared secret during local development.

How to use it

  1. 1Paste the JWT, including both dots.
  2. 2Read the decoded header, payload and human-readable timestamps.
  3. 3Optionally enter the HMAC secret and press Verify signature.
  4. 4Never paste production tokens into untrusted online tools — this page keeps them local.

Worked examples

Typical payload

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiIsInJvbGUiOiJhZG1pbiIsImV4cCI6MTgwMDAwMDAwMH0.signature

Output

{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "sub": "42",
  "role": "admin",
  "exp": "2027-01-15T08:00:00.000Z"
}

Common mistakes

  • Trusting a decoded token as authentic without checking the signature.
  • Accepting alg: none or trusting the alg header from the token instead of pinning an algorithm server-side.
  • Treating exp as a guarantee — clock skew and missing revocation still matter.

Frequently asked questions

Does decoding a JWT verify it?
No. Decoding only Base64URL-decodes the segments. Verification requires checking the signature with the correct key and validating iss, aud and exp claims.
Why can't I verify my RS256 token here?
RS256 needs the issuer's RSA public key and a JWKS lookup. This tool only performs HMAC verification because it can do that entirely locally.
Are tokens sent to a server?
No. Decoding and HS256/384/512 verification both use browser APIs. The token never leaves your device.
Is it safe to store a JWT in localStorage?
Any script running on the page can read localStorage. For high-security apps, prefer HttpOnly, Secure, SameSite cookies and short token lifetimes.

Related tools

All tools

Base64 Decoder

Decode standard or URL-safe Base64 back to readable text.

Runs locally

Hash Generator

MD5 and SHA digests for text or files, computed locally.

Runs locally

JSON Formatter

Beautify or minify JSON, with precise error positions.

Runs locally

UUID Generator

Bulk random UUID v4 generation with format options.

Runs locally