◎ SEOlust
Text/Utilities

JWT Decoder

Decode JSON Web Tokens to inspect the header and payload, with human-readable expiry, and optional HS256 signature verification.

All tools

About the JWT Decoder

Decode a JSON Web Token to inspect its header and payload, see human-readable expiry, and optionally verify HMAC signatures — all locally in your browser.

What this tool does

Paste a JWT and the tool splits it into header, payload, and signature, decodes the base64url segments, and pretty-prints the JSON. Time claims like exp, iat, and nbf are shown as readable dates, and expired tokens are flagged.

Signature verification

For HMAC algorithms (HS256, HS384, HS512) you can paste the secret to check whether the signature is valid. The check runs in your browser using the Web Crypto API. Asymmetric algorithms (RS, ES, PS) rely on public/private key pairs and are not verified here.

  • Green check: the secret matches and the token is authentic.
  • Red cross: the secret is wrong or the token was tampered with.
  • Decoding a JWT does not require the secret — only verification does.

Security note

A JWT payload is only base64-encoded, not encrypted — anyone can read it. Never store secrets or sensitive data in a JWT payload, and always verify the signature server-side before trusting a token.

FAQ

Is my token sent to a server?
No. Decoding and verification happen entirely in your browser; the token and secret never leave your device.
Can it verify RS256 tokens?
Not currently. RS/ES/PS algorithms use key pairs; this tool verifies the HMAC (HS) family, which uses a shared secret.
Why can I read the payload without a key?
JWT payloads are base64url-encoded, not encrypted. The signature protects integrity, not confidentiality.
What does 'expired' mean?
The exp claim is a timestamp after which the token should be rejected. If it is in the past, the token is expired even if the signature is valid.

Related tools

Pro tip: pair this tool with Upside Down Text Generator and Text Similarity Checker for a faster SEO workflow.

  • Upside Down Text Generator — Flip text upside down using Unicode. Perfect for social media.
  • Text Similarity Checker — Compare two texts and calculate similarity percentage to detect duplication or overlap.
  • Styled Text Generator — Generate bold, italic, strikethrough, underline text. 6 variations.
  • Emoji Density Analyzer — Analyze emoji usage density in text to avoid overuse and improve readability and SEO balance.
  • Text to Speech — Convert text to speech using Web Speech API. Multiple voices, speed/pitch control, free & private. Perfect fo…