What is the difference between decoding and verifying a JWT?

Decoding only Base64url-decodes the header and payload — it works on any well-formed token, including forged or tampered ones. Verifying recomputes the HMAC (HS256) or signature check using a secret or public key and confirms the token was actually issued by your auth server. Use the Decode tab for inspection; use the Verify tab to prove authenticity.

Can this tool verify the JWT signature?

Yes — open the Verify tab, paste the token, and provide the shared HS256 secret. The tool recomputes the HMAC-SHA256 signature in your browser using the Web Crypto API and returns valid or invalid. For RS256 or ES256 (asymmetric algorithms), verification must happen on the server with the corresponding public key.

Is my JWT or secret sent to a server?

No. Decoding, signing, and verification all happen locally via the Web Crypto API. Tokens and secrets never leave your browser — no upload, no logging, no analytics on the content.

Why does my decoded payload show numbers instead of dates?

JWT timestamps (iat, exp, nbf) are Unix timestamps — seconds since January 1, 1970 UTC. The decoder surfaces the parsed expiry above the JSON, and you can paste the raw number into the Timestamp Converter tool to read other claims.

What is the alg: none vulnerability?

Some JWT libraries trust the header's alg field to decide which algorithm to verify with. If your server accepts alg: none, an attacker can submit a forged token with no signature and have it accepted. Always pin the expected algorithm on the server side and reject none explicitly.

What's the difference between the header and payload?

The header contains the token type and signing algorithm (alg, typ). The payload contains the claims — standard fields like iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued at), nbf (not before), plus any custom data your app embeds.

Can I decode a JWT that's been modified?

Yes — any valid Base64url string decodes. That's exactly why decoding alone proves nothing. The signature is what binds the header and payload to the issuer; any change to either invalidates the signature on verify.

Should I use HS256 or RS256?

Use HS256 when the issuer and verifier share one trusted secret (single backend). Use RS256 (or ES256) when verifiers should not be able to issue tokens — the private key signs, the public key verifies. This tool covers HS256 fully; RS256 tokens decode but verification needs server-side public-key checks.

Entwickler-Utilities

JWT Tool

JWT-Tokens lokal dekodieren, signieren und verifizieren.

Ihre Daten bleiben auf Ihrem GerätKein Upload, kein ServerFunktioniert offline

Tokens are signed locally in your browser. Never share your secret key.

JWT token

Algorithm

HS256

Subject

toolgrid

Expires at

11.12.2026, 23:00:00

Decoded header

{
  "alg": "HS256",
  "typ": "JWT"
}

Decoded payload

{
  "sub": "toolgrid",
  "exp": 1797030000
}

Warum dieses Tool verwenden

JWT-Claims inspizieren, signierte Tokens mit HS256 erstellen und Signaturen im Browser verifizieren.

Das JWT-Tool kombiniert Dekodierung, Erstellung und Verifizierung an einem Ort.

Tokens mit HMAC-SHA256 signieren und Signaturen lokal verifizieren – ohne Secrets an einen Server zu senden.

So wird's verwendet

01Dekodieren: Ein beliebiges JWT einfügen, um Header und Payload-Claims zu prüfen.

02Erstellen: Einen JSON-Payload und ein Secret angeben, um einen signierten HS256-Token zu generieren.

03Verifizieren: Einen Token und sein Secret einfügen, um zu prüfen, ob die Signatur gültig ist.

Schnellcheck vor dem Kopieren

Confirm the input is the format you intended.

Scan the result before using it in a document, URL, config, or message.

Copy only the output you need.

FAQ

Wird mein JWT beim Dekodieren an einen Server gesendet?

Nein. Das Dekodieren erfolgt vollständig im Browser. JWTs aus Produktionssystemen können sicher eingefügt werden.

Warum zeigt der Payload Zahlen statt Datumsangaben?

JWT-Timestamps (iat, exp, nbf) sind Unix-Timestamps: Sekunden seit dem 1. Januar 1970 UTC.

Was ist der Unterschied zwischen Header und Payload?

Der Header enthält den Token-Typ und den Signaturalgorithmus. Der Payload enthält die Claims: Benutzerdaten, Berechtigungen, Ablaufdatum usw.

JWT Tool

Warum dieses Tool verwenden

So wird's verwendet

Schnellcheck vor dem Kopieren

FAQ

Verwandte Tools

JSON Formatter

Base64 Encoder / Decoder

Hash Generator

JWT Tool

JSON Formatter→

Base64 Encoder / Decoder→

Hash Generator→

JSON Formatter

Base64 Encoder / Decoder

Hash Generator