CodeBeautifyJWT Decoder
Decode JWT tokens online. Inspect the header and payload of a JSON Web Token, view human-readable expiry and issued-at dates, and verify HS256, HS384, or HS512 signatures.
What is a JWT?
A JSON Web Token (JWT, defined in RFC 7519) is a compact, URL-safe way to represent claims to be transferred between two parties — most commonly used to carry authentication and authorization data in web APIs. A JWT consists of three Base64url-encoded, dot-separated segments: header.payload.signature.
- Header — declares the token type and the signing algorithm (e.g.
HS256). - Payload — the actual claims, such as
sub(subject),iat(issued-at), andexp(expiry). - Signature — proves the token wasn't altered and, for symmetric algorithms, that the issuer knows the shared secret.
Because the header and payload are only encoded — not encrypted — anyone who has the token can read its contents. JWTs should never be used to store secrets, and should always be transmitted over HTTPS.
How signature verification works here
For HS256, HS384 and HS512 tokens, this tool recomputes the HMAC signature over header.payload using the secret you provide (via the browser's built-in Web Crypto API) and compares it to the token's signature. Nothing you type ever leaves your browser. RS256/ES256 and other asymmetric algorithms verify with a public key instead of a shared secret and aren't supported by this simplified tool.
Frequently asked questions
How do I decode a JWT online?
Paste your JWT into the input box and click Decode. The JWT decoder splits the token and shows its header and payload as readable JSON instantly.
How do I verify a JWT signature?
Enter the signing secret and click Verify Signature. For HS256, HS384, or HS512 tokens, the tool recomputes the signature in your browser and tells you whether it matches.
Is decoding a JWT the same as verifying it?
No. The header and payload of a JWT are only Base64url-encoded, not encrypted, so anyone can decode and read them without a secret. Verifying checks the signature to confirm the token wasn't tampered with and was issued by someone who holds the secret or private key.
Why can't this tool verify RS256 or ES256 tokens?
RS256 and ES256 are asymmetric algorithms that verify with a public key rather than a shared secret. This tool currently supports verification for the symmetric HS256, HS384 and HS512 algorithms; asymmetric verification may be added separately.
What do the exp, iat and nbf claims mean?
They are standard JWT claims expressed as Unix timestamps: iat is when the token was issued, exp is when it expires, and nbf is the time before which the token must not be accepted. This tool shows their human-readable date next to each value.