Skip to content
motifuse
Developer

JWT Decoder

Decode JWT header, payload, signature, registered claims, and expiry, with optional client-side HMAC verification for HS256, HS384, and HS512.

  • Free public tool
  • No sign-up for this tool
  • Processing clearly labeled
  • Instant results

Content last reviewed

Decoded and verified entirely in your browser — the token and secret never leave this page.

Quick Start

  1. Add input

    Paste a three-segment JWT and optionally enter its HMAC secret.

  2. Choose options

    Load sample, copy segments, clear input, and verify supported HMAC algorithms.

  3. Review the result

    Check the output or diagnostics, then use the available copy or download control where shown.

Examples

Representative example

This example reflects the implemented transformation or analysis.

Input

header.payload.signature

Output

Decoded header and payload, signature text, claim explanations, time status, and optional verification result.

Input and output example 1

Input

header.payload.signature

Output

Decoded header and payload, signature text, claim explanations, time status, and optional verification result.

About the JWT Decoder

JWT Decoder addresses a focused developer workflow without requiring a command-line setup. Decode JWT header, payload, signature, registered claims, and expiry, with optional client-side HMAC verification for HS256, HS384, and HS512. Results update from the supplied input, making it useful for quick inspection, debugging, documentation, or test preparation.

In this tool, JWT Decoder: processing runs in the browser and the tool does not call an external conversion API. Input remains in page memory unless a confirmed browser feature such as file reading or local settings is described above.

How to Use JWT Decoder

  1. Paste a three-segment JWT and optionally enter its HMAC secret.

  2. Configure load sample, copy segments, clear input, and verify supported hmac algorithms.

  3. Review the generated output, status, or validation message.

  4. Copy or download the result when that control is available, and verify it in the destination where it will be used.

Key Features

  • Focused processing

    The tool Base64url-decodes header and payload as UTF-8 JSON. It interprets known claims and uses Web Crypto HMAC signing to compare HS256/384/512 signatures.

  • Input guidance

    Compact JWTs with exactly three dot-separated segments.

  • Immediate feedback

    Wrong segment count, invalid Base64url, or non-JSON header/payload produces a targeted error.

When to Use JWT Decoder

  • Application development

    Use JWT Decoder to prepare or inspect values while implementing a feature.

  • Fault isolation

    Run a small known input through JWT Decoder to distinguish formatting or syntax problems from surrounding application behavior.

  • Reviewable examples

    Create a concise decoded header and payload, signature text, claim explanations, time status, and optional verification result. for tests, documentation, or code review.

How It Works

Processing flow

The tool Base64url-decodes header and payload as UTF-8 JSON. It interprets known claims and uses Web Crypto HMAC signing to compare HS256/384/512 signatures.

Result handling

During processing, JWT Decoder: the result is rendered directly in the tool interface. Validation failures are displayed instead of being silently treated as successful output.

Supported Formats and Options

Formats

  • Accepted input

    Compact JWTs with exactly three dot-separated segments

  • Displayed output

    Decoded header and payload, signature text, claim explanations, time status, and optional verification result.

Options

  • Available controls

    Load sample, copy segments, clear input, and verify supported HMAC algorithms

Common Errors and Troubleshooting

Common errors

  • Invalid or incomplete input

    Wrong segment count, invalid Base64url, or non-JSON header/payload produces a targeted error.

  • Unexpected result

    Confirm that the selected mode or syntax matches the source and that the input is complete.

Troubleshooting guide

Resolve the reported error

Wrong segment count, invalid Base64url, or non-JSON header/payload produces a targeted error. Reduce the input to the smallest failing case and confirm the selected controls.

Check an unexpected result

Review the documented limitation for JWT Decoder, then compare a known example with the same mode or syntax before processing a larger value.

Limitations and Important Notes

Decoding is not verification. Only HMAC HS256, HS384, and HS512 can be verified; asymmetric algorithms require public-key support not provided here.

Privacy and Data Processing

The token and optional HMAC secret are decoded and checked with browser APIs. They are not submitted to a verification server; treat production tokens and secrets as sensitive anyway.

Tips and Best Practices

Practical tips

  • Keep the original compact jwts with exactly three dot-separated segments before using JWT Decoder.

  • Exercise the error case described as: Wrong segment count, invalid Base64url, or non-JSON header/payload produces a targeted error.

  • Check the result against this limitation: Decoding is not verification. Only HMAC HS256, HS384, and HS512 can be verified; asymmetric algorithms require public-key support not provided here.

Best practices

Prepare a representative input

Start with a small value whose expected result you understand, then add the edge cases relevant to JWT Decoder. Preserve the original when the conversion or formatting is destructive.

Verify in context

Decoding is not verification. Only HMAC HS256, HS384, and HS512 can be verified; asymmetric algorithms require public-key support not provided here. Treat the displayed result as an intermediate artifact and test it in the runtime, parser, database, or document where it will actually be used.

Technical Details

Implementation note: JWT Decoder: the tool Base64url-decodes header and payload as UTF-8 JSON. It interprets known claims and uses Web Crypto HMAC signing to compare HS256/384/512 signatures.

Who Is This For?

Developers, QA engineers, technical writers, analysts, and students who need decode JWT header, payload, signature, registered claims, and expiry, with optional client-side HMAC verification for HS256, HS384, and HS512.

Frequently Asked Questions

Does JWT Decoder send input to an API?

No external processing API is used by this tool; its implemented operation runs in the browser.

What input is supported?

Compact JWTs with exactly three dot-separated segments.

Why did the tool show an error?

Wrong segment count, invalid Base64url, or non-JSON header/payload produces a targeted error.

What should I verify before using the result?

Decoding is not verification. Only HMAC HS256, HS384, and HS512 can be verified; asymmetric algorithms require public-key support not provided here.

Find this useful? Share it.