🎫JWT DecoderReady

Inspect a three-part JWS locally, read UTF-8 claims and time context, and verify an exact HS256, HS384, or HS512 signature with a known secret.

Inspect a compact JWS

Supports three Base64URL segments: protected header.payload.signature. Five-part encrypted JWEs are identified but never decrypted.

Press Ctrl/Cmd + Enter to inspect. Pasted compact tokens are capped at 100,000 characters to protect browser responsiveness.

Capability checkedVerified September 9, 2026

What works

Strictly decode canonical unpadded Base64URL and UTF-8 JSON without uploading the token
Distinguish a five-part encrypted JWE from the three-part JWS form this tool can inspect
Use the browser Web Crypto API to verify an exact supported HMAC algorithm against the original protected-header.payload bytes

Important limits

Decoding never proves that claims are authentic; the receiving application must enforce its expected algorithm, trusted key, issuer, audience, required claims, and policy
The tool never fetches jku, x5u, JWKS, certificates, or other header-provided key locations and does not verify RSA, ECDSA, EdDSA, or JWE tokens

Reviewed capability guide

What the JWT Decoder does—and does not do

Exact supported inputs, outputs, limits, and primary sources for the current implementation.

Accepted input

A compact three-segment JWS token: protected-header.payload.signature
An optional known UTF-8 HMAC secret when the protected header is exactly HS256, HS384, or HS512
A JSON object, a selected HMAC algorithm, and sufficiently long random key material when creating a local test token

Produced output

UTF-8 decoded protected-header and payload JSON, plus the exact signature segment
Informational exp, nbf, and iat time context using the browser clock
A local HMAC signature-match result for HS256, HS384, or HS512 and the supplied secret
A locally signed compact HMAC JWS for a controlled integration test

Operational limits

Pasted compact serializations are limited to 100,000 characters to protect browser responsiveness
Only three-part JWS Compact Serialization is inspected; five-part JWE, JSON serializations, and b64:false payloads are intentionally not decoded
Signature verification supports only exact HS256, HS384, and HS512 values with a secret supplied in this browser
Temporal claim context uses the browser clock with no configured clock-skew allowance

Known limitations

Decoding never proves that claims are authentic; the receiving application must enforce its expected algorithm, trusted key, issuer, audience, required claims, and policy
The tool never fetches jku, x5u, JWKS, certificates, or other header-provided key locations and does not verify RSA, ECDSA, EdDSA, or JWE tokens
A matching HMAC result only proves a match to the supplied secret and exact compact signing input; it is not complete token validation
Length checks on an HMAC secret cannot establish that the secret is random, unique, safely stored, or encoded as another system expects
JSON is displayed through the browser parser, so a duplicate object-member name is not preserved for inspection or used to assess a receiver's duplicate-claim policy

Standards and primary sources

Continue the workflow

Json Formatter →Password Generator →

Capability claims last reviewed September 9, 2026. Review dates describe the implementation audit, not content freshness by itself.

Reviewed workflow

Use the JWT Decoder with the right expectations

Start by separating inspection from trust. This tool decodes the three-part JWS compact form locally, labels a five-part JWE as encrypted rather than pretending it can read it, and makes the original protected-header.payload string visible to its HMAC verifier. It never follows a token's key URL, guesses an algorithm, or treats a readable claim as authenticated.

When it is the right tool

Reading a compact JWS while debugging an authentication integration
Checking whether exp, nbf, or iat explain a time-related test failure
Confirming an HS256, HS384, or HS512 signature against a shared secret you already know
Creating a controlled local HMAC test token with a generated secret

A deliberate choice

Tooleras keeps this page specific to the job above instead of claiming support for adjacent formats, platforms, or edge cases it cannot verify. Open the capability guide for the exact inputs, outputs, limits, and sources.

Checked examples

A token that looks readable but is not trusted

header.alg = HS256 · payload.sub = demo-user · signature present

The decoder renders the JSON and can test a supplied secret, while still requiring the receiving application to enforce its issuer, audience, time, and authorization rules.

A five-part encrypted compact token

protected-header.encrypted-key.iv.ciphertext.tag

The tool identifies it as a JWE and explains that decryption needs the recipient's key; it does not expose a misleading empty payload view.

Need a different tool?

Browse the full catalogue — all free, with data handling documented per tool.

Browse all tools