JWT Decoder & Debugger
Decode any JSON Web Token, read its claims in plain English, verify the signature, and re-sign or tamper with HMAC tokens. Works with HS, RS, ES and PS algorithms and the alg:none test. Your token never leaves your browser.
Typing a secret verifies the token. Editing the header or payload, or hitting Re-sign, forges a new HMAC signature.
Decode a JSON Web Token
Paste a token in the Encoded box and the header and payload are base64url decoded instantly into readable JSON. Standard claims like exp, nbf and iat are shown as real dates with an expiry badge, so you can see at a glance whether a token is still valid. Nothing is uploaded, the decoding runs entirely in your browser.
Verify the signature
For HS256, HS384 and HS512, drop in the shared secret and the status flips to Signature verified or Invalid signature. For RS256/384/512, PS256/384/512 and ES256/384/512, paste a PEM public key to check an asymmetric signature. Verification uses the browser's native Web Crypto API.
Re-sign and tamper, and the alg:none test
Edit the header or payload and, for HMAC tokens, the signature is recomputed live with your secret, so you can forge a tampered token to throw at a test target. Set the algorithm to none to emit an unsigned token and check whether a server wrongly accepts it, the classic JWT verification bypass.
Only test tokens and keys you own or are authorised to assess. Everything here stays in your browser, no token, secret or key is ever sent anywhere.
Missing an encoding or a feature?
Tell me what to add next, or report a bug. It goes straight to 0xDext3r.