Can I decode a JWT without the secret key?

Yes — decoding and verifying are separate operations. Decoding is just a Base64URL-decode, no key needed at all. Verifying checks the signature using the secret or public key, which is a separate step this tool also supports.

What happens if I paste an expired token?

The tool decodes it completely and shows the full payload regardless of expiration. The `exp` claim appears next to its readable date, making it obvious the token has already expired.

What's the difference between HS256 and RS256?

HS256 is symmetric — the same secret key both signs and verifies the token. RS256 is asymmetric — a private key signs it, and a different public key verifies it. RS256 is preferred in distributed systems where you don't want every service holding the signing secret.

Why does my JWT signature verification fail?

Usually a mismatched secret, the wrong algorithm selected, or the token payload being altered after signing. Double-check you're using the exact secret and algorithm the token was originally signed with — even a trailing space or wrong encoding breaks the match.

Is my token or secret sent to a server?

No. All decoding and verification happens in your browser via the Web Crypto API. Nothing leaves your device, and the tool keeps working offline once it has loaded.

JWT Decoder

Decode and inspect JSON Web Tokens instantly — view header, payload, verify HMAC signatures, and generate JWT code in PHP, JavaScript, Python, and Java.

Updated May 2026

ENCODED

DECODED

Paste a JWT token on the left to decode it

GENERATE JWT CODE

Language

Algorithm

javascript

 1const jwt = require('jsonwebtoken');
 2
 3const secretKey = 'your-256-bit-secret';
 4
 5const payload = {
 6  sub: '1234567890',
 7  name: 'John Doe',
 8  iat: Math.floor(Date.now() / 1000)
 9};
10
11const token = jwt.sign(payload, secretKey, { algorithm: 'HS256' });
12console.log(token);
13
14// To verify:
15const decoded = jwt.verify(token, secretKey, { algorithms: ['HS256'] });
16console.log(decoded);

How to decode a JWT token

Decode, verify, and generate code in seconds

1. Paste your token

The three parts appear color-coded instantly — header in pink, payload in purple, signature in cyan.

2. Inspect the claims

`iat`, `exp`, and `nbf` are converted to readable dates automatically — spot an expired token at a glance.

3. Verify the signature

For HS256/384/512, enter the secret key and get an instant green or red verification badge.

What this JWT decoder does

A complete JWT debugger, not just a viewer

Instant decoding

Header, payload, and signature highlighted in color — no key required to read them.

Readable timestamps

exp, iat, and nbf are converted to ISO dates automatically, no manual Unix math.

HMAC signature verification

HS256, HS384, and HS512 signatures verified directly in your browser with your secret key.

Code generation

Ready-to-use signing snippets in JavaScript, PHP, Python, and Java for your own project.

JWT decoding examples

What to expect for a few real-world cases

Situation

What the tool shows

Reference token from jwt.io

`alg: HS256`, `sub`, `name`, `iat` — no `exp` set

Expired token (`exp` in the past)

Expiration date shown next to the raw Unix timestamp

Malformed token (2 parts)

Error: "Expected format: header.payload.signature"

Token with `alg: none`

Decodes normally, verification marked as "not supported"

When you'll reach for this tool

The most common scenarios among developers who use it

Debugging a 401 Unauthorized

Check exp, aud, and the algorithm before writing a single line of code.

Security audits

Confirm no sensitive data is leaking through the payload claims.

Integration testing

Verify the right claims, TTL (exp minus iat), and algorithm before writing tests.

Signature verification

Confirm a token was signed with the expected secret between services.

Learning the JWT structure

A color-split view of the three parts, no need to read the RFC first.

Generating signing code

Ready-made snippets save you from hunting down the right method in each library.

Common JWT mistakes

Confusing decoding with verifying

Decoding just reads the payload without checking the signature. A token can decode fine and still be forged.

Storing JWTs in localStorage

Accessible to any JavaScript running on the page — one XSS vulnerability steals every active token.

Skipping the `exp` claim check

A stolen token stays valid indefinitely. 15 minutes is the 2026 best practice, paired with a refresh token.

Sensitive data in the payload

It's Base64URL, not encryption. Never put a password, card number, or SSN in a JWT payload.

Why use this JWT decoder

Beyond basic decoding, it verifies HMAC signatures directly in your browser and generates ready-to-use code in four languages — a full debugger, not just a payload viewer.

Everything runs locally through the Web Crypto API. Your token and your secret never leave your device, even when you verify a signature.

Frequently asked questions

The payload is only Base64URL-encoded, not encrypted. Anyone holding the token string can decode and read it without a key. The signature only proves who issued the token — it doesn't hide the content.

Resources

jwt.io

The canonical JWT reference and interactive debugger, maintained by Auth0.

IETF RFC 7519 — JSON Web Token

The official specification defining the JWT format, claims, and processing rules.

Auth0 — Introduction to JSON Web Tokens

A practical guide to JWT structure, signing, and common usage patterns.