JWT Decoder, Verifier & Generator
Decode header and payload, verify HS256/384/512 signatures with a secret, or sign new tokens — all in your browser. Tokens never leave your device.
Decode vs verify
Decoding only Base64URL-decodes the JWT parts so you can read claims. Verification checks the HMAC signature with your shared secret using the Web Crypto API. Asymmetric algorithms (RS256, ES256) are not supported in this version.
Is it safe?
Processing stays client-side. Still avoid pasting production secrets or long-lived tokens on shared machines. Prefer short-lived test tokens when debugging.