JWT Decoder & Verifier
Decode, build, and verify JWT tokens — entirely client-side (HS256).
Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. TOOLGRID measures tool usage, not the content you enter.
Loading tool…
Browser-basedWhat this tool does
Free JWT decoder, builder, and HS256 signature verifier. Inspect header and payload claims, sign new tokens, and validate signatures locally. Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. Browser-local processing avoids a TOOLGRID upload path, but it is not a blanket security guarantee.
Decoding and verifying are different operations — decoding only Base64url-decodes the parts (useful for inspection, never proves authenticity), while verifying recomputes the HMAC signature with your secret. Most security incidents come from confusing the two; this tool keeps them in separate tabs so you cannot mix them up.
JWT work uses the browser's Web Crypto API. Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. Browser-local processing avoids a TOOLGRID upload path, but it is not a blanket security guarantee.
What you can do with this tool
Paste a JWT from your app's local storage or authorization header to inspect the user ID, roles, and expiry without writing code.
When a user reports they can't access a resource, decode their JWT to check if their role claim or expiry is the cause.
Confirm that your auth server is issuing tokens with the correct claims before writing application code that depends on them.
What to check before relying on the result
- Performance and maximum practical input size depend on browser memory, device speed, and the structure of the input.
- Review the generated result before replacing or publishing an original file.
How to use
- 1
Decode: paste any JWT to inspect header and payload claims.
- 2
Build: provide a JSON payload and secret to produce a signed HS256 token.
- 3
Verify: paste a token and secret to check whether the signature matches.
Use Cases
Paste a JWT from your app's local storage or authorization header to inspect the user ID, roles, and expiry without writing code.
When a user reports they can't access a resource, decode their JWT to check if their role claim or expiry is the cause.
Confirm that your auth server is issuing tokens with the correct claims before writing application code that depends on them.
Decode a JWT's payload to read the exp (expiry) timestamp and verify whether a token is still valid.
Tips & Tricks
A JWT payload is only Base64url-encoded, not encrypted. Anyone who has the token can decode and read its claims. Never put sensitive data in the payload.
The exp field contains seconds since Jan 1 1970 UTC. Use the Timestamp Converter tool to convert it to a human-readable date.
Decoding only Base64url-decodes the header and payload — it tells you nothing about whether the token is authentic. The Verify tab supports HS256 shared-secret checks only; it does not accept public keys or verify RS256/ES256 tokens. A matching signature proves possession of the supplied secret, not the issuer's identity or the trustworthiness of the claims.
A JWT looks like xxxxx.yyyyy.zzzzz. The first part is the header (algorithm), the second is the payload (claims), the third is the signature.
If a server accepts tokens with header alg: none, anyone can forge a token by setting alg: none and omitting the signature. Your server should reject the none algorithm explicitly — never decide trust based on the header's alg value alone.
FAQ
What is the difference between decoding and verifying a JWT?
Decoding only Base64url-decodes the header and payload — it works on any well-formed token, including forged or tampered ones. This tool's Verify tab only recomputes an HS256 HMAC with the supplied shared secret. A match does not by itself prove who issued the token or that its claims should be trusted.
Can this tool verify the JWT signature?
It can verify HS256 only: open the Verify tab, paste the token, and provide the shared secret. The tool does not accept a public key and cannot verify RS256, ES256, or other asymmetric algorithms. A signature match confirms the token matches that secret; it does not establish issuer identity or claim validity.
Is my JWT or secret sent to a server?
Decoding, signing, and verification use the browser's Web Crypto API. Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. Browser-local processing avoids a TOOLGRID upload path, but it is not a blanket security guarantee.
Why does my decoded payload show numbers instead of dates?
JWT timestamps (iat, exp, nbf) are Unix timestamps — seconds since January 1, 1970 UTC. The decoder surfaces the parsed expiry above the JSON, and you can paste the raw number into the Timestamp Converter tool to read other claims.
What is the alg: none vulnerability?
Some JWT libraries trust the header's alg field to decide which algorithm to verify with. If your server accepts alg: none, an attacker can submit a forged token with no signature and have it accepted. Always pin the expected algorithm on the server side and reject none explicitly.
What's the difference between the header and payload?
The header contains the token type and signing algorithm (alg, typ). The payload contains the claims — standard fields like iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued at), nbf (not before), plus any custom data your app embeds.
Can I decode a JWT that's been modified?
Yes — any valid Base64url string decodes. That's exactly why decoding alone proves nothing. For HS256, the signature binds the header and payload bytes to the supplied shared secret; any change invalidates that check, but a match does not identify the issuer.
Should I use HS256 or RS256?
Use HS256 only when issuer and verifier can safely share one secret. RS256 or ES256 separates private-key signing from public-key verification. This tool signs and verifies HS256 only; it has no public-key input, although RS256 or ES256 token contents can still be decoded for inspection.
Useful next steps
Open a nearby browser tool when you need to validate, convert, or reuse the result.