Is my JWT sent to a server?

No. Decoding and signature verification run entirely in your browser — your token and any secret you enter never leave your device. You can confirm this by opening the Network tab or disconnecting from the internet after the page loads.

Is it safe to paste a real token into an online JWT decoder?

With most online decoders, no — a JWT is a bearer credential, and pasting a live one into a site that sends it to a server can leak access. That is exactly why this tool is client-side: nothing is transmitted. Still, treat production tokens carefully and prefer test tokens where possible.

Can you verify the signature?

Yes, for symmetric algorithms (HS256, HS384, HS512): enter the secret and the tool recomputes the HMAC in your browser and compares it. Asymmetric tokens (RS256, ES256, etc.) are decoded but not verified, since that requires the issuer's public key.

What are the three parts of a JWT?

A JWT is header.payload.signature, each Base64URL-encoded and separated by dots. The header names the algorithm, the payload holds the claims (who the token is for, when it expires), and the signature proves the token was issued by someone holding the key.

JWT Decoder

Decode and verify JSON Web Tokens — in your browser, never uploaded

100% Private — your data never leaves your device

Your token and secret are decoded and verified in your browser. Nothing is sent to any server — safe for real tokens.

Paste your JWT

Reading a JWT

A JWT is header.payload.signature. Decoding shows the header and claims (this is not secret — anyone with the token can read it). The signature proves who issued it; only verification with the key tells you the token is authentic and untampered.