HedgieTools

JWT decoder

Read a JWT's content, its dates in plain language and whether it's still valid, and check its signature, without ever sending it to a server.

Your token

Paste a JWT to decode it, right here in your browser.

Decoded content

The header, the payload and what each claim means.

Verify signature

Optional: check the token was signed by the right party.

Decode a JWT privately

Paste a JWT to see its header and payload in plain text, with every claim explained. Its issue and expiry dates are converted to local time, and the tool shows whether the token is still valid.

Why decode locally

A JWT often grants access to an account or an API. Pasting it into a site that sends it to a server risks it being reused. Here, everything happens in your browser: the token and the key are never transmitted.

Encoded, not encrypted

A JWT's content is just Base64-encoded: anyone can read it. The signature only guarantees it hasn't been modified. Never put a password or sensitive data inside one.

Verify the signature

With the shared secret (HS256, HS384, HS512) or the public key (RS256, ES256…), the tool checks that the token was really signed by the right party and hasn't been altered.

Related tools

Development

Social Share Preview

See how a page looks when shared on Google, Facebook, X, LinkedIn and more, and copy ready-to-paste Open Graph tags (og tags, Twitter card, meta tags).

Development

SVG to HTML

Convert SVG to HTML, JSX and React.