JWT decoder & verifier

A JSON Web Token is a compact, URL-safe token with three base64url parts — header, payload, and signature — used to carry claims between parties, most commonly for authentication and authorisation.

No. A standard signed JWT (JWS) is not encrypted — the header and payload are base64url-encoded plaintext that anyone can decode. The signature only proves integrity and authenticity, not confidentiality. Never put secrets in a JWT payload.

No. Decoding and signature verification run entirely in your browser using built-in APIs. Your token, secret, and keys never leave the page.

HS256 is a symmetric HMAC algorithm — the same secret signs and verifies. RS256 is asymmetric — a private key signs and the corresponding public key verifies, so you can hand out the public key without exposing signing power.

Usually you pasted the wrong secret or public key, the key format is off (HMAC expects the raw secret, asymmetric expects a PEM SPKI public key), or the token uses an algorithm this tool does not support. Double-check the alg field in the header.