A JSON Web Token is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. APIs use JWTs as bearer tokens. Decode reads the parts. Encode builds an HS256-signed token for tests.

Does this decoder verify the signature?

No. The Decode tab never verifies. Verification needs the secret or public key and must happen on a trusted server. Decoding only shows what the token claims, which anyone can forge.

Can I encode or sign a JWT here?

Yes, on the Encode tab of this same page - there is no separate jwt-encoder URL. It signs compact JSON with HMAC-SHA256 (HS256) in your browser. Use a disposable test secret, never a production key.

Why only HS256 and not RS256?

HS256 is HMAC with a shared secret and runs in the Web Crypto API without uploading a private key. RSA and ECDSA need key pairs and belong on a server. This page pins alg to HS256 so the header cannot say RS256 while the bytes are HMAC. For the raw HMAC hex digest of a message plus secret, use HMAC mode on Hash Generator.

Is my token or secret sent to a server?

No. Decode and Encode run entirely in your browser. Nothing you paste is uploaded, logged, or stored.

Why do I see an error?

A valid JWT has exactly three parts. The header and payload must be Base64URL-encoded JSON. Extra dots, missing parts, or corrupted encoding produce a friendly error. Encode also rejects invalid header or payload JSON and an empty secret.

Can I trust exp, sub, or role claims from this tool?

Not by themselves. Anyone can create a token with any claims. Use Decode to debug tokens you already have, then verify signatures in your backend.

Base64URL is Base64 with + and / replaced by - and _, and padding often omitted. JWT header and payload use this encoding so tokens are URL-safe.

How do I convert JWT exp/iat Unix timestamps into a date?

In a JWT payload, iat is issued-at Unix time and exp is expires-at Unix time. This page already shows UTC and local clocks for those claims. You can also copy the numbers into the Unix Timestamp Converter: https://www.toolsminify.com/converter-tools/timestamp-converter.

Developer Tools

JWT Decoder

Paste a JSON Web Token to inspect its header, payload, and signature.

Mode

HS256 only

JSON Web Token

Decode only - this view does not verify the signature. Do not trust claims until a server verifies the token.

About JWT Decoder

Paste a JSON Web Token to inspect its header, payload, and signature. This free JWT decoder splits the token on dots, Base64URL-decodes the first two parts, and pretty-prints the JSON. Decode does not verify the signature - treat claims as untrusted until a server checks them. The Encode tab signs a compact HS256 token in your browser with Web Crypto; the secret never leaves the page. RSA is not offered. Everything runs client-side.

How to Use JWT Decoder

Decode is the default tab. Paste a JWT. A Bearer prefix is optional and is stripped automatically.
The header and payload appear as pretty-printed JSON. Time claims (iat, exp, nbf) show Unix seconds plus UTC and local clocks. The signature is the raw third segment.
Switch to Encode to sign a test token. Header JSON is pre-filled with alg HS256. Edit the payload, optionally tap a NumericDate chip for iat or exp, then enter a secret and sign.
Copy the token, or send it to the Decode tab to inspect the compact JSON that was actually signed. If input is malformed, a short error explains whether the structure, encoding, or JSON is wrong.

JWT Decoder Examples

Standard three-part JWT

header.payload.signature decodes to a JSON header (alg, typ), a JSON payload (claims such as sub, iat, exp), and a Base64URL signature.

Authorization header

Paste Bearer eyJ... - the tool strips the Bearer prefix and decodes the token.

Unsecured JWT (alg none)

A token with an empty third segment still decodes. The signature field is blank - Decode still does not verify anything.

HS256 test token

On Encode, keep the HS256 header, set payload claims, enter a dev-only secret, and sign. The output is a compact three-part JWT you can paste into Postman or send to Decode.

What Is Inside a JWT

Read the full guide

How to Use JWT Decoder: Complete Guide (2026) - 5 min read

Frequently Asked Questions about JWT Decoder

What is a JWT?: A JSON Web Token is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. APIs use JWTs as bearer tokens. Decode reads the parts. Encode builds an HS256-signed token for tests.
Does this decoder verify the signature?: No. The Decode tab never verifies. Verification needs the secret or public key and must happen on a trusted server. Decoding only shows what the token claims, which anyone can forge.
Can I encode or sign a JWT here?: Yes, on the Encode tab of this same page - there is no separate jwt-encoder URL. It signs compact JSON with HMAC-SHA256 (HS256) in your browser. Use a disposable test secret, never a production key.
Why only HS256 and not RS256?: HS256 is HMAC with a shared secret and runs in the Web Crypto API without uploading a private key. RSA and ECDSA need key pairs and belong on a server. This page pins alg to HS256 so the header cannot say RS256 while the bytes are HMAC. For the raw HMAC hex digest of a message plus secret, use HMAC mode on Hash Generator.
Is my token or secret sent to a server?: No. Decode and Encode run entirely in your browser. Nothing you paste is uploaded, logged, or stored.
Why do I see an error?: A valid JWT has exactly three parts. The header and payload must be Base64URL-encoded JSON. Extra dots, missing parts, or corrupted encoding produce a friendly error. Encode also rejects invalid header or payload JSON and an empty secret.
Can I trust exp, sub, or role claims from this tool?: Not by themselves. Anyone can create a token with any claims. Use Decode to debug tokens you already have, then verify signatures in your backend.
What is Base64URL?: Base64URL is Base64 with + and / replaced by - and _, and padding often omitted. JWT header and payload use this encoding so tokens are URL-safe.
How do I convert JWT exp/iat Unix timestamps into a date?: In a JWT payload, iat is issued-at Unix time and exp is expires-at Unix time. This page already shows UTC and local clocks for those claims. You can also copy the numbers into the Unix Timestamp Converter: https://www.toolsminify.com/converter-tools/timestamp-converter.

Hash Generator

Generate SHA-256, SHA-1, SHA-384, and SHA-512 hashes from any text. HMAC lives on the same page. Get the lowercase hex digest instantly in your browser - nothing is uploaded.

Unix Timestamp Converter

Convert Unix timestamps (seconds or milliseconds) into ISO 8601, UTC, and your local date/time. Convert local dates back into Unix seconds and milliseconds. Runs in your browser.

Base64 Encoder / Decoder

Free online Base64 encoder and decoder. Encode text to Base64 or decode Base64 back to plain text, with full Unicode (UTF-8) support - runs entirely in your browser.