AUTHENTICATION · JWT

{ } JWT Decoder

Decode and inspect JSON Web Tokens privately.

Paste a JWT to inspect its header, payload and claims. Optionally verify a supported signature using your own key. Everything runs in your browser.

✓ Token inspection✓ Optional verification⚠ Decoding is not validation

INPUT / 01

JWT Token

Enter a compact JWT with three dot-separated segments.

◆ Token inspection

OUTPUT / 02

Decoded token

Token inspection

Enter a token and click Decode to see the result.

VERIFY / 03

Cryptographic signature verification

Decoding does not authenticate a token. Verify an HMAC or RSA signature using a key kept only in your browser.

Not verified

Verification key

ALG: —

Never enter production secrets on devices you do not control. We do not store or transmit keys.

LEARN / JWT

Understanding a JWT

Header

Declares an algorithm (alg) and type (typ). Servers must not blindly trust algorithms declared inside untrusted tokens.

Payload

Contains claims such as sub, iss, aud, exp and iat. It is typically encoded, not encrypted, so anyone holding the token can read it.

Signature

A signature establishes integrity and authenticity only when checked with a trusted key and expected algorithm.

FAQ

Frequently asked questions

Does decoding mean a JWT is valid?

No. Reading segments does not check the signature, issuer, audience or authorization. Even a valid signature is only one part of validation.

Are my JWTs sent to SixHack Academy?

No. This tool never makes network requests to process tokens. Page and static files are downloaded normally to display the website.

Which algorithms can it verify?

HMAC HS256, HS384 and HS512, plus RS256, RS384, RS512, PS256, PS384 and PS512 through Web Crypto. You can inspect other algorithms, but cannot verify them here.

SIXHACK ACADEMY

Keep learning

Dive deeper into authentication, authorization and web security at SixHack Academy.

Explore web training ↗