Does this tool verify the JWT signature?

No. JWT Decode only reads (decodes) the header and payload — it does not validate the signature. Signature verification requires the secret or public key and must be done server-side. This tool is not a substitute for professional security review.

Is my token sent to your servers?

No. All decoding happens in your browser using client-side JavaScript. Your token is never transmitted over the network, making it safe to use with real access tokens.

Which signing algorithms are supported?

All standard JWT algorithms (HS256, RS256, ES256, PS256, etc.) are supported for decoding because the process is simply Base64url decoding, which is algorithm-agnostic. The algorithm is displayed in the header panel.

Can I decode an expired token?

Yes. The tool decodes regardless of expiry status. An expired token is flagged with a clear warning next to the exp field so you can see it immediately.

Yes, completely free. No sign-up or subscription required.

What about refresh tokens — can those be decoded too?

Only if the refresh token is itself a JWT. Many providers issue opaque refresh tokens (random strings), which cannot be decoded. If it contains two dots and looks like a JWT, the tool will parse it.

Does it work on mobile?

Yes. The tool is mobile-responsive. Copy the token from your API client and paste it on mobile for a quick check.

JWT Decoder — Free Online Tool

🔒

Privacy: Your token is decoded entirely in your browser and never sent to any server. Still, avoid pasting production secrets into public tools.

JWT Token

✅ Token valid (not expired)· exp: 3/17/2030, 5:46:40 PM

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ali Veli",
  "iat": 1516239022,
  "exp": 1900000000
}

📖 Claim Explanations

sub		1234567890
name		Ali Veli
iat		1/18/2018, 1:30:22 AM
exp		3/17/2030, 5:46:40 PM

🔐 Signature Verification (Optional — HS256)

Enter the secret key to verify the signature in your browser. HS256 (HMAC-SHA256) only.

Note: Unless you enter a secret key, this tool does NOT verify the signature — it only decodes.

Auto-deleted in 7 days

256-bit SSL

Support

Your files are encrypted with SSL and automatically deleted from our servers 7 days after processing.

📖 How to Use

Upload document

Drag-drop or pick file.

Set options

Choose operation and parameters.

Process

Server runs the task.

Download

Get result in your format.