Is it safe to paste a production JWT into this tool?

Decoding and verification both run entirely in your browser using client-side JavaScript — nothing is transmitted anywhere. That said, treat any token or secret you paste as sensitive: avoid pasting live production tokens into any tool, this one included, if the token is currently active and tied to a real user session, since anyone who later reads the clipboard or browser history could extract it.

Why can I read the payload without entering any secret?

JWT header and payload are Base64URL-encoded, not encrypted — this is a reversible text encoding with no key involved, not a security measure. Anyone holding the token, with or without the signing secret, can decode and read every claim inside it. Only the signature requires the secret, and only the signature proves the token is genuine.

What is the actual difference between decoding a JWT and verifying it?

Decoding just reads the Base64URL-encoded text back into JSON — it works on any string with the right shape, real or fabricated. Verifying recomputes the expected signature from the header and payload using the actual signing key and confirms it matches the signature segment in the token, which is the only step that proves the token has not been tampered with or forged.

What does the "exp" claim mean and what happens if it has passed?

exp is a Unix timestamp (seconds since epoch) marking when the token stops being valid. A backend should reject any request bearing a token whose exp has already passed, regardless of whether the signature itself still checks out — an expired-but-correctly-signed token must still be rejected.

Why does this tool only verify HS256 and not RS256 or ES256?

HS256 is symmetric — the same secret both signs and verifies, which matches the common scenario of testing a token against a shared secret you already hold. RS256 and ES256 are asymmetric, verified with a public key rather than a shared secret; while technically possible to add, HS256 covers the overwhelming majority of self-issued token testing scenarios this tool is built for.

What happens if I edit the payload of a JWT and re-encode it myself?

The resulting token will decode and display fine, since decoding does not check the signature — but running signature verification against it with the original secret will report the signature as invalid, because the recomputed signature over your edited payload no longer matches the original signature segment. This is exactly the tamper-detection JWTs are designed to provide.

What is the "alg: none" vulnerability I have heard about?

Some early JWT libraries would accept a token whose header declared alg: "none" and skip signature checking entirely, letting an attacker forge any payload they wanted. Modern JWT libraries reject "none" by default, but it is a reminder to always verify that your server-side verification code explicitly pins the expected algorithm rather than trusting whatever algorithm the token header claims to use.

Should I store a JWT in localStorage or as an httpOnly cookie?

This tool does not make that architectural decision for you, but it is worth knowing the tradeoff: localStorage is readable by any JavaScript on the page, making a token there vulnerable to XSS, while an httpOnly cookie cannot be read by JavaScript at all, which is generally the safer default for session tokens at the cost of needing CSRF protections instead.

Why is my signature verification failing even though I am sure the secret is correct?

The most common cause is an invisible difference in the secret string itself — trailing whitespace, a different character encoding, or a base64-encoded secret being pasted in its encoded form rather than its raw decoded form. Copy the secret directly from its source (environment variable, secrets manager) rather than retyping it, and confirm your signing code is not base64-decoding the secret before use if this tool is not doing the same.

All ToolsVerify & Decode JWT

Verify & Decode JWT

Decode JWT tokens to inspect header and payload. Optionally verify HS256 signatures with a secret key.

ilovedocstools.com

Verify & Decode JWT

Processing…

Processed on your device

What is Verify & Decode JWT?

Verify & Decode JWT is a free online tool that decodes a JSON Web Token into its three constituent parts — header, payload, and signature — and displays each in a clearly separated, color-coded, pretty-printed view. It also checks the exp (expiration) claim against the current time and, when you supply the signing secret, cryptographically verifies an HS256 signature using the browser's native SubtleCrypto API.

A JWT is three Base64URL-encoded segments joined by dots: a header describing the signing algorithm and token type, a payload holding the actual claims (who the token represents, what it grants, when it expires), and a signature that binds the first two segments together so any tampering can be detected. The critical thing to understand about the first two segments is that Base64URL encoding is not encryption — it is a reversible text encoding, the same category of transformation as Base64 or URL-encoding, with no secret key involved in reading it. Anyone holding a JWT, including a browser extension, a network proxy, or a curious user opening devtools, can decode the header and payload and read every claim inside without knowing anything about how the token was signed. This is precisely why JWTs should never carry passwords, raw credit card numbers, or other genuinely secret data in their payload — only the signature is protected, never the content.

The signature is what actually matters for trust. It proves the token was issued by whoever holds the corresponding signing key and that the header and payload have not been altered since — decoding alone tells you nothing about whether a token is genuine, only what it claims to say. This distinction trips up a surprising number of implementations: code that decodes a JWT to read a user ID but never calls the actual verify function is trusting user-controlled input as if it were authenticated, because a payload can be freely edited and re-encoded by anyone, and only signature verification catches that the resulting token no longer matches what was originally signed.

JWTs use two broad signing approaches. HS256 (HMAC-SHA256) is symmetric — the exact same secret string is used both to sign the token and to verify it, so anyone who can verify a token could also forge one, which makes it appropriate mainly for single-service, first-party use where the signer and verifier are the same system. RS256 and ES256 are asymmetric — the token is signed with a private key that never leaves the issuing server, and verified anywhere using only the corresponding public key, which is why they are preferred whenever multiple independent services need to verify tokens issued by one central authority without being able to forge new ones themselves. This tool implements the interactive verify path for HS256 specifically, since that is the common case for testing tokens issued by your own backend where you already hold the shared secret.

Beyond the signature itself, several standard claims are worth checking manually every time: exp (expiration, a Unix timestamp after which the token must be rejected), iat (issued-at time), nbf (not-before, a time before which the token is not yet valid), iss (issuer), aud (intended audience), and sub (subject, typically the user ID). This tool automatically checks exp against your current system time and reports the token as valid or expired, but every other claim should be reviewed manually against what your application expects, since a syntactically valid, correctly signed token can still carry claims that do not authorize the specific action being attempted.

How It Works

The token is split on its two dot separators into header, payload, and signature segments. The header and payload segments are Base64URL-decoded (converting the URL-safe alphabet back to standard Base64, restoring padding, and running the result through atob) and then parsed as JSON for display. If a payload contains an exp claim, that Unix timestamp is compared against Date.now() to report the token as currently valid or expired. When a secret is supplied for verification, the tool uses the browser's native SubtleCrypto API to import the secret as a raw HMAC key configured for SHA-256, computes an HMAC signature over the exact original header.payload string (not the decoded JSON, since re-encoding could produce different bytes), Base64URL-encodes that computed signature, and compares it directly against the signature segment from the token — a match confirms the token was signed with that exact secret and has not been altered since.

How to Use

1
Paste your JWT
Paste the complete token — all three dot-separated segments: header.payload.signature — into the token field.
2
Decode
Click "Decode JWT" to instantly see the parsed header, payload, and raw signature, plus an automatic valid/expired status if the payload includes an exp claim.
3
Review the claims
Check the decoded payload for the specific claims your application cares about — sub, iss, aud, iat, and any custom claims — not just the automatic expiry check.
4
Enter the signing secret
If you need to confirm the token is genuine and not just well-formed, enter the HS256 secret used by the issuing server into the secret field.
5
Verify the signature
Click "Verify Signature" to have the tool recompute the expected HMAC-SHA256 signature and compare it against the token's actual signature.
6
Act on the result
Treat a VALID signature with an unexpired exp as trustworthy for your testing purposes; treat any INVALID result, or a missing check entirely, as proof the token cannot be trusted as-is.

Who Uses This Tool

🔍

Debugging Auth Issues

Paste a JWT from a failing request to instantly see its claims and verify whether the token has expired.

🧪

Testing Token Contents

Inspect the payload of tokens generated by your auth server to confirm custom claims are included correctly.

🔐

Signature Verification

Confirm that a token was signed with the correct secret key before trusting its claims in a staging environment.

📚

Security Education

Demonstrate to developers that JWT payloads are readable without a secret to teach safe token handling practices.

⏰

Expiry Inspection

Check the exp claim and see a human-readable expiry time and validity status to diagnose session timeout bugs.

🛠️

Third-Party Token Audit

Decode tokens received from external OAuth providers to verify the structure matches your expected schema.

Why Choose This Tool

No Secret Required to Decode

Header and payload are decoded instantly from any JWT without needing the signing secret, for quick inspection.

Expiry Status Indicator

Displays a clear valid or expired badge based on the exp claim so you can diagnose session issues at a glance.

Optional Signature Verification

Provide the HMAC secret to verify the signature cryptographically and confirm the token was not tampered with.

Color-Coded Sections

Header, payload, and signature are each rendered in a distinct color for easy visual separation.

Formatted JSON Output

Decoded header and payload are pretty-printed as JSON so nested claims are easy to read and copy.

Completely Private

All decoding and verification runs in your browser — your token and secret never leave your device.

Also Try

JWT Generator Base64 Encode/Decode Hash Generator JSON Formatter Regex Tester Password Generator

Key Benefits

Decodes header and payload instantly with no secret required
Automatic expiry check against your current system time (valid or expired)
Optional cryptographic HS256 signature verification using SubtleCrypto
Color-coded header, payload, and signature sections for fast visual scanning
Pretty-printed JSON output with individual copy buttons per section
Uses the exact original encoded segments for verification, avoiding re-encoding mismatches
No token, secret, or claim data is ever sent to a server
Works on tokens from any HS256-signing backend — Node, Python, Java, PHP, and more

Frequently Asked Questions

Also Known As

jwt decoder online freedecode jwt token onlineverify jwt signature onlinejwt inspector browser baseddecode json web token payloadonline jwt viewer toolcheck jwt expiry onlinejwt verifier no login required