eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
Click to editValid JWT Structure
Header
Payload (read-only)
Paste a JSON Web Token to decode its header and payload instantly, then add a secret or public key to verify the signature. Nothing leaves your browser.
Yes — everything runs client-side in your browser. Tokens, secrets, and keys are never sent to a server; there is no backend at all. You can confirm this yourself by opening the Network tab in your browser’s developer tools and watching that nothing is transmitted as you type.
A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three base64url-encoded parts separated by dots: a header naming the signing algorithm, a payload carrying the claims, and a signature that lets the receiver confirm the token has not been altered.
HS256 is symmetric: the same secret both signs and verifies, so anyone able to verify a token can also forge one. RS256 is asymmetric: a private key signs and a separate public key verifies, so you can distribute verification ability without granting the power to issue tokens.
Usually the key does not match the one used to sign the token, the token was modified after signing, or the selected algorithm differs from the one named in the header. For PEM keys, check that line breaks and the BEGIN/END armour were pasted intact — a single missing newline invalidates the key.
The "exp" (expiration time) claim holds a Unix timestamp after which the token must be rejected. This tool checks it and flags expired tokens, but expiry is not part of the signature — the service receiving the token is still responsible for enforcing it.
Yes. This tool covers the same core workflow — decoding, verifying, and generating tokens across HS256/384/512, RS256/384/512, and ES256/384/512 — as a free, fully client-side alternative.