Can this tool verify the JWT signature?

Signature verification needs your secret (HS256) or public key (RS256/ES256). For security, signature checks should happen in your backend — this tool is a viewer, not a verifier.

What's the difference between a JWT and a JWS?

A JWS is the cryptographic structure: header.payload.signature. A JWT is a JWS where the payload is a JSON object of claims. Almost every JWT is also a JWS.

Is it safe to paste a real production token?

Yes — decoding happens entirely in your browser. Nothing is transmitted, logged or stored. Still, once a token is in your clipboard, treat it as a credential.

Why is the signature shown as opaque bytes?

The signature is a cryptographic blob, not encoded data — only the issuer's key can verify it. The Base64URL form is shown for completeness.

JWT Decoder — Free Online Tool

What is the JWT Decoder?

The JWT Decoder is a free online security tools from Markvibe. Decode JSON Web Tokens to inspect header and payload. It runs entirely in your browser — your data never gets uploaded — and works on desktop, tablet and mobile with no sign-up.

Reviewed by The Markvibe Team · Last updated 2026-06-28

Example

A worked example so you know exactly what to expect.

Input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiTWFya3ZpYmUifQ.signature

Output

Header: { "alg": "HS256" }
Payload: { "sub": "123", "name": "Markvibe" }

How to use JWT Decoder

1Paste your JWT (three Base64URL parts separated by dots) into the input.
2The decoder splits the token into Header, Payload and Signature and pretty-prints the JSON for each.
3Common claims are annotated: iss, sub, aud, exp, iat, nbf, jti — with exp/iat shown in human-readable local time.
4If the token is expired, the panel shows a red badge with how long ago it expired.
5Decoding is local-only — your token is never sent to our servers, so it's safe to paste production tokens.