JWT Parser
Decode, verify and encode JSON Web Tokens in your browserAlgorithm:HMAC-SHA256 · symmetric · shared secret
Encoded Token
Decoded token will appear here with colour-coded sections
Header
—
Payload
—
Signature
—
For HS256: enter the shared HMAC secret key
Ctrl↵ to decode
About JWT Parser
Decode any JWT to inspect its header and payload. Verify signatures with HMAC secrets or RSA/ECDSA public keys. Encode new tokens with all 9 algorithms. 100% browser-side — your tokens never leave your device.
Supported Algorithms
| Algorithm | Type | Hash | Key Type |
|---|---|---|---|
HS256 | Symmetric | SHA-256 | Shared secret string |
HS384 | Symmetric | SHA-384 | Shared secret string |
HS512 | Symmetric | SHA-512 | Shared secret string |
RS256 | Asymmetric | SHA-256 | RSA 2048+ bit key pair |
RS384 | Asymmetric | SHA-384 | RSA 2048+ bit key pair |
RS512 | Asymmetric | SHA-512 | RSA 2048+ bit key pair |
ES256 | Asymmetric | SHA-256 | EC P-256 key pair |
ES384 | Asymmetric | SHA-384 | EC P-384 key pair |
ES512 | Asymmetric | SHA-512 | EC P-521 key pair |
Frequently Asked Questions
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token that encodes a JSON payload and a cryptographic signature. It enables stateless authentication — a server signs the token at login; clients send it with each request; any server holding the key can verify it without a database lookup.
Can a JWT decoder verify the signature?
Yes. Paste the JWT and the secret (for HMAC algorithms) or the public key (for RSA/ECDSA). The tool verifies the signature using the Web Crypto API entirely in your browser. If verification passes, the token is authentic and unmodified. If it fails, the token was tampered with, issued by a different secret, or the wrong algorithm is selected.
What is the difference between decoding a JWT and verifying it?
Decoding reads the header and payload — anyone can do this since the data is only Base64-encoded, not encrypted. Verifying checks the signature to confirm the token was issued by a trusted party using the correct secret or private key. Never trust a JWT's claims without verifying the signature first.
What JWT algorithms are supported?
The tool supports all standard algorithms: HMAC (HS256, HS384, HS512), RSA (RS256, RS384, RS512), RSA-PSS (PS256, PS384, PS512), and ECDSA (ES256, ES384, ES512). All cryptographic operations run via the browser's Web Crypto API — no JWT library is used.
Is it safe to paste a JWT into an online tool?
Use caution. JWTs often contain sensitive claims (user ID, roles, email) in the readable payload. This tool processes everything in your browser — no JWT is sent to any server. For extra safety, replace real claim values with placeholders before testing. Never paste tokens with embedded credentials like API keys.