JWT Decoder & Verifier Pro
Read what is actually inside a token, and check that the signature holds. Both happen in your browser, which matters, because a JWT is a credential. Free preview · Pro required to export. Decode tokens up to 2,000 characters free. Signature verification and larger tokens need Pro.
Free preview · Pro required to export. Decode tokens up to 2,000 characters free. Signature verification and larger tokens need Pro.
Why use this tool?
- A token you paste into a website is a token you have to treat as compromised — unless it never leaves your machine.
- Most "expired token" bugs are visible immediately once you can read the exp claim.
- Decoding is not verifying: a decoded token proves nothing until the signature is checked.
How to use JWT Decoder
- Paste the token. Header and payload are decoded straight away.
- Read the claims, including issued-at and expiry as real dates.
- To verify, supply the shared secret for HMAC or the public key for RSA and ECDSA.
Frequently asked questions
Is my token sent to a server?
No. Decoding and signature verification both run in your browser. Nothing is transmitted, which is the only safe way to inspect a live token.
What is the difference between decoding and verifying?
Decoding just Base64-decodes the parts, which anyone can do. Verifying checks the signature against a key and proves the token has not been altered.
Can I try this Pro tool without an account?
Yes. Decode tokens up to 2,000 characters free. Signature verification and larger tokens need Pro. Your own input is processed locally in your browser.
Will upgrading keep my work?
Checkout and login open in a separate tab. Keep the workspace open to retain inputs, settings and previews. Files stay in that tab only; keep the originals in case you close or reload it. Export access is checked with the server after payment.
Your files are processed directly in your browser and are not uploaded to HubToolify's servers.