Is it safe to decode a JWT online?

Yes, if the tool runs entirely in your browser. Our JWT decoder uses client-side JavaScript only — your token is never sent to any server. You can verify this yourself by opening the browser's developer tools and checking the Network tab while using the tool.

What does 'exp' mean in a JWT?

The 'exp' claim is the expiration time of the token, expressed as a Unix timestamp (seconds since January 1, 1970 UTC). After this time, the token should be rejected by the server. Our tool shows a human-friendly 'Expires in 2 hours' or 'Expired 3 days ago' badge to make this easy to understand.

How do I verify a JWT signature?

For HMAC algorithms (HS256, HS384, HS512), paste the token in decode mode, enter your secret key, and click 'Verify'. The tool uses the Web Crypto API to recompute the signature and compares it to the token's signature. If they match, the token is authentic.

Can I decode a JWT without the secret key?

Yes. Decoding (reading the header and payload) does not require the secret key — JWT payloads are just base64url-encoded JSON. However, you need the secret key to verify that the signature is authentic and the token hasn't been tampered with.

Does this tool support RS256 and ES256?

Currently, this tool supports decoding of all JWT algorithms (since decoding only requires base64url decoding), but signing and verification are limited to HMAC algorithms (HS256, HS384, HS512). Asymmetric algorithms like RS256 and ES256 require private/public key pairs and are not yet supported.

JWT Encoder / Decoder

Decode, verify, and create JSON Web Tokens — 100% client-side

100% client-side — your token never leaves your browserAll decoding happens locally using JavaScript. Nothing is sent to any server.

Paste your JWT token

Paste a JWT token above to decode it instantly

Nothing is sent to any server

About This Tool

Free online JWT decoder and encoder. Paste any JWT to instantly see the decoded header, payload, and expiry status. Create signed JWTs with HS256, HS384, or HS512. All processing happens locally in your browser — your tokens never leave your device.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way of representing claims to be transferred between two parties. JWTs are commonly used for authentication and information exchange in modern web applications.

A JWT consists of three parts separated by periods (.):

Header — Contains the token type (JWT) and the signing algorithm (e.g., HS256). It's base64url-encoded JSON.
Payload — Contains the claims (statements about the user and metadata). Also base64url-encoded JSON. Common claims include sub (subject), exp (expiration), iat (issued at), and iss (issuer).
Signature — Used to verify the token hasn't been tampered with. Created by signing the encoded header and payload with a secret key (HMAC) or private key (RSA/ECDSA).

The structure looks like this: header.payload.signature

🔑 How to Use

🔹 Decode a JWT

Click the "Decode JWT" tab (default).
Paste your JWT token into the input box.
Header and Payload are automatically decoded and shown as JSON.
Check the expiry badge to see when the token expires.
Optionally enter the secret key and click "Verify" to check the signature.
Click any Copy button to copy individual sections.

🔹 Encode a JWT

Click the "Encode JWT" tab.
Choose your algorithm (HS256, HS384, or HS512).
Enter your secret key.
Edit the Header and Payload JSON directly, or use the claims helper.
Click "Generate JWT Token".
Copy the resulting token.

🔹 Understand Standard Claims

iss — Issuer (who created the token)
sub — Subject (who the token is about)
aud — Audience (who the token is for)
exp — Expiration time
nbf — Not before (token not valid before this time)
iat — Issued at (when the token was created)
jti — JWT ID (unique identifier)

🔹 Verify a Signature

Decode an HMAC-signed token (HS256, HS384, or HS512).
In the Signature section, enter the secret key.
Click "Verify".
A green badge means the signature is valid; a red badge means it's invalid (wrong key or token was modified).

💡 Pro Tips

✔ Privacy First – Never paste production tokens into untrusted tools. This tool runs 100% client-side.
✔ Expiry Check – Look for the expiry badge at the top — it's the fastest way to see if a token is still valid.
✔ Timestamp Conversion – Click any Unix timestamp to see it as a human-readable date.
✔ Tamper Detection – If you verify a token and it fails, someone may have modified the payload.
✔ JWT is not encrypted – Anyone can read the payload. Don't put sensitive data (passwords, PII) in a JWT.

What is a JWT?

A JWT consists of three parts separated by periods (.):

Header — Contains the token type (JWT) and the signing algorithm (e.g., HS256). It's base64url-encoded JSON.

Payload — Contains the claims (statements about the user and metadata). Also base64url-encoded JSON. Common claims include sub (subject), exp (expiration), iat (issued at), and iss (issuer).

Signature — Used to verify the token hasn't been tampered with. Created by signing the encoded header and payload with a secret key (HMAC) or private key (RSA/ECDSA).

The structure looks like this: header.payload.signature