JWT decoder

Paste a JSON Web Token to read its header and payload — decoded in your browser, not uploaded to our servers for processing.

Tool processing runs in your browser — your pastes/files are not uploaded to our servers for processing. Ads (if shown) load separately and do not receive your tool inputs.Advertising · Details

Quick answer

A JWT is three Base64URL parts (header.payload.signature). TryDevSnip decodes claims locally, flags alg:none, shows an expiry countdown, and can optionally verify HS256 with a secret via Web Crypto.

Security note. Treat production tokens carefully. Anyone who sees a valid JWT can use it until it expires. Prefer staging tokens; never put secrets in the URL.Processing stays in your browser — inputs are not uploaded to our servers for processing.

JSON Web Token

Live tool — decodes as you type. Prefill is a demo token (fake signature, not verified). Use HS256 verify below only with a secret you already trust.

Demo sample loaded — replace with your JWT. Decoding is local; signature is not proven until you verify.

Header

Payload

Optional HS256 verify

Enter the shared secret to verify HS256 signatures with Web Crypto. Secret is not sent to our servers.

Secret

Decode by default. Signature verify is optional and HS256-only. Never trust a token’s contents without validating it on your server for production traffic.

Rate this tool

Frequently asked questions

How do I decode a JWT?

A JWT has three Base64URL parts separated by dots: header.payload.signature. Paste it and the header and payload JSON are decoded and pretty-printed. This runs in your browser — the token is not uploaded to our servers for processing.

Does this verify the signature?

Optionally for HS256: enter the shared secret and we verify with Web Crypto in your browser. RS256/ES256 need public keys — use your server for those. Never trust a token in production without server-side validation.

What is alg:none?

Some libraries historically accepted tokens with "alg":"none" and an empty signature — a known attack. This tool flags alg none (and empty alg) so you notice insecure tokens immediately.

Is it safe to paste a real token here?

Decoding and optional HS256 verify happen entirely in your browser. Still treat production tokens carefully — anyone who sees a valid token can use it until it expires.

What are exp and iat?

exp is the expiry time and iat is the issued-at time, both Unix timestamps. This tool shows them as dates plus a live countdown to expiry.

Debugging LLM API responses? TryTokka watches AI API spend — same maker, optional.