JWT Decoder & Verifier
Decode the header and payload of a JSON Web Token, inspect standard claims with human-readable timestamps, and verify HS256 signatures — all locally in your browser.
About the JWT Decoder
Updated June 2026 · 100% client-side — your data never leaves your browser.
A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL-encoded parts — header, payload and signature — separated by dots. Bytewrench's JWT decoder splits the token and decodes the header and payload so you can inspect claims like issuer, subject, expiry and custom data in readable JSON.
Decoding happens entirely in your browser, so you can safely inspect access tokens and ID tokens without sending them to a third-party service.
See also: Base64 decoder, Hash generator
Instantly view the decoded header and payload claims as formatted JSON.
Standard claims like iat, exp and nbf are easy to interpret at a glance.
Tokens are decoded locally — never transmitted or logged.
Drop in any JWT and see its structure immediately, no configuration needed.
Frequently asked questions
Does decoding a JWT verify it?
No. Decoding only reads the Base64URL-encoded header and payload; it does not check the signature. A token can be perfectly readable yet forged or expired. Verification requires the signing key and must happen server-side.
Can someone read my JWT if I paste it?
A JWT is not encrypted — its header and payload are just Base64URL and anyone who has the token can read every claim inside it. That's why you should never put secrets in a JWT payload, and should treat live tokens like passwords.
What's inside a JWT?
Three dot-separated parts: a header (the signing algorithm and token type), a payload of claims such as iss, sub, aud, iat and exp plus any custom data, and a signature that proves the first two parts weren't tampered with.
What is the difference between HS256 and RS256?
HS256 is symmetric — the same secret key signs and verifies the token. RS256 is asymmetric — a private key signs and a public key verifies, so you can distribute the public key without letting others mint tokens. RS256 is preferred when verification happens across multiple services.
Is it safe to decode a production token here?
Decoding happens entirely in your browser and nothing is uploaded, so it's safe technically. Still, treat live access tokens with care and avoid pasting them where others can see your screen.