Tools Blog

JWT Encoder/Decoder/Verifier

Scan to open this page

Nothing here ever leaves your browser — no network requests are made. Open your browser's DevTools Network tab while using this tool to confirm it yourself.

Decode a JWT's header and payload instantly, see exp/iat as readable dates with expiry status, and verify an HS256 signature — entirely in your browser, with zero network requests.

How it works

  1. Paste a JWT to see its decoded header and payload, with exp/iat shown as readable dates
  2. Optionally enter the HS256 secret to verify the signature — computed locally via the Web Crypto API
  3. Switch to the Encode tab to build and sign your own JWT from a header, payload, and secret

Frequently asked questions

Does my JWT get sent to a server?

No. Decoding and signature verification both happen entirely in your browser — no network requests are made. Open your browser's DevTools Network tab while using this tool to confirm it yourself.

Is it safe to type in my secret key?

Yes — the secret never leaves your browser either. It's used only to compute the HMAC-SHA256 signature locally via the Web Crypto API for comparison.

What algorithms are supported for verification?

HS256 (HMAC-SHA256) currently. Asymmetric algorithms like RS256 may be added later.

#JwtDecoderOnline#JwtDecoderClientSideOnlyNoServer#DecodeJwtWithoutSendingToken#JwtSignatureVerificationBrowserOnly

Related tools

Base64 Encoder/Decoder Base64 Encoder/Decoder RSA Key Pair Generator RSA Key Pair Generator

From the blog

A security write-up on JWT decoders warns that tools offering signature verification are more likely to process your token server-side. Ours proves it doesn't, in your own DevTools.
dev

A security write-up on JWT decoders warns that tools offering signature verification are more likely to process your token server-side. Ours proves it doesn't, in your own DevTools.

Pasting a JWT into the wrong tool can leak whatever's in its claims — user IDs, emails, permissions. A write-up on this exact risk says trustworthy decoders should let you verify the privacy claim yourself. Ours tells you to open the Network tab and check, because there's nothing to hide.

2026-08-29

Update history

  • 2026-08-30 Added: a cover image — used as the card thumbnail, social share image, and blog title image.
  • 2026-08-29 Launched: live JWT decoding (header + payload), human-readable exp/iat with expiry status, HS256 signature verification entirely via the browser's Web Crypto API — no network requests, verifiable in DevTools.