Loading...
Please wait while we prepare your experience
Loading...
Please wait while we prepare your experience
Decode JWT tokens to view header and payload data
Decode JWT tokens to view header and payload. Optionally verify the signature with a secret key. All processing happens locally in your browser - no data is sent to any server.
Four tools for every JWT task — decode, generate, verify, and create signing secrets.
Choose a tool
Select Decoder to inspect a token, Generator to create one, Verifier to validate a signature, or Secret Generator to create a signing key.
Paste your token or fill in the fields
For the decoder and verifier, paste an existing JWT. For the generator, fill in the header and payload fields.
Copy the result
Copy the decoded payload, generated token, verification result, or signing secret.
Reading a token from the Network tab
Copy the Authorization header value from your browser's Network tab, paste it into the decoder, and see exactly what claims are inside — expiry, user ID, roles, whatever your app puts there.
Testing how your API handles different claims
Generate a token with a specific exp, sub, or custom claim to test edge cases — expired tokens, missing roles, wrong issuer — without touching your auth server.
Confirming a token wasn't tampered with
Paste the token and your signing secret into the verifier. If the signature doesn't match, the token was modified after it was issued.
Creating a signing secret for a new project
The secret generator produces a cryptographically random string suitable for HMAC-SHA256 signing. Don't use a human-readable password as a JWT secret.
Onboarding a developer to your auth system
Decode a real token from your app and walk through the header, payload, and signature. Faster than reading documentation.
Found a problem with Jwt? Let us know.
Your feedback helps us improve.