§

Paste your JWT

Parsing and signature verification both run locally. Nothing about the token is sent to a server.
§

Header

json
§

Payload

json
§

Verify signature

Enter a secret to verify the signature.

JSON Web Tokens drive the US authentication stack — from AWS Cognito ID tokens, through Auth0 and Okta access tokens, to the Stripe-signed event tokens that webhook receivers must verify. UK financial-services teams operating under the Open Banking framework rely on the same RFC 7519 envelope with FAPI-flavoured profiles, where the `iss` claim points at the ASPSP's well-known JWKS endpoint. This decoder splits the three Base64URL segments inside the browser, surfaces the header, payload, and signature, and decodes standard claims like `exp`, `iat`, and `nbf` with proper time-zone rendering — without your bearer token ever leaving the tab or appearing in a server-side log.

// Related Tools

./base64-decoder
Base64 Decoder
Inspect base64url-encoded header and payload segments outside the JWT envelope.
→
./url-decoder
URL Decoder
Pull JWTs out of percent-encoded query strings and redirect URLs.
→
./json-formatter
JSON Formatter
Pretty-print and validate the decoded payload as standalone JSON.
→
./
All Tools
Browse the full set of Ultim8Soft online tools.
→

What is a JSON Web Token?

A JSON Web Token (JWT) is a compact, URL-safe envelope for a small claims payload. It is the standard credential format for stateless web sessions, OAuth/OIDC ID tokens, machine-to-machine API auth, and signed magic links. A JWT is always three base64url segments joined with dots: header.payload.signature. The header and payload are JSON; the signature is a binary MAC or digital signature over the first two segments.

How do JWTs work?

When this tool decodes a token it walks the same three-step path every JWT library follows:

  1. Split the token on dots into exactly three non-empty segments. Any other shape is malformed.
  2. Base64url-decode segments 0 and 1, then JSON.parse each. The header carries the algorithm (alg) and token type (typ). The payload carries the claims (sub, exp, iat, custom keys).
  3. If a secret is provided, recompute the MAC over <segment0>.<segment1> using the algorithm in the header. Compare bytes against the third segment.
  4. Surface the verification result alongside the decoded claims, including a human-readable expiry indicator computed from the exp claim.

Why decode JWTs in the browser?

Pasting a real, in-use JWT into a remote debugger leaks the credential to that service's logs, observability stack, and any partner the service ships data to. Even when the third-party site claims not to log tokens, you have no way to verify it. This tool was built so you never have to make that compromise:

  • Zero network: the runtime has no fetch, XMLHttpRequest, or sendBeacon calls. Open DevTools while you decode and verify — the Network panel stays silent.
  • Native Web Crypto: HMAC verification uses crypto.subtle.importKey and crypto.subtle.sign, the same primitives your runtime would call.
  • Static deploy: every page is a single static HTML file with no server endpoint to compromise. There is no token to leak because there is no server to leak it to.

What does this tool verify, and what does it not?

Version 1 of this tool verifies HMAC-SHA family signatures only. Concretely:

  • Supported: HS256, HS384, HS512. Provide the shared secret and the tool will recompute and compare the MAC.
  • Not yet supported: RS256/384/512 (RSA), ES256/384/512 (ECDSA), EdDSA, and PS256/384/512 (RSA-PSS). These require a public key in PEM or JWK form and are deliberately deferred to a follow-up release.
  • Refused: alg: "none". The tool decodes the token but explicitly flags it as insecure — no signature validation is happening, and any production system that accepts such a token has a serious vulnerability.

What does a JWT decoding example look like?

Paste the canonical RFC 7519 example token into the input field above:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

The header decodes to {"alg":"HS256","typ":"JWT"} and the payload to {"sub":"1234567890","name":"John Doe","iat":1516239022}. Enter your-256-bit-secret in the verify panel and the signature check returns valid. Change a single character of the secret and it returns invalid. None of this leaves your browser.

This is the JWT decoder we wished existed when we needed to debug a token in production: privacy-respecting, fast, and built on the same primitives the runtime uses.