Is decoding a JWT the same as verifying it?

JWT Debugger, Inspector & Studio

Cryptography & Hashes100% Client-Side

Decode, verify signatures (HMAC SHA-256), live edit claims, inspect standard timestamps, and run JWT security vulnerability audits.

Encoded JWT Token(Editable — Paste or modify below)

Color-Coded Segments

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkRldlRvb2xraXQgVXNlciIsImFkbWluIjp0cnVlLCJpYXQiOjE3MjUwMDAwMDAsImV4cCI6MTgwMDAwMDAwMH0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

HeaderPayloadSignature

Signature Verification & Signing

Enter Secret Key to verify

HMAC Secret Key (256-bit+ recommended)

Decoded JSON Sections

Header (Algorithm & Type)

// No Header

Payload (Claims & Data)

// No Payload

What is JWT Debugger, Inspector & Studio?

A comprehensive in-browser JWT Studio and Security Debugger. Decode headers and claims, edit payloads in real-time, verify HMAC signatures with your secret key, and audit tokens for common vulnerabilities like "alg: none" and weak secrets.

How to Use Online

1
Paste Encoded JWTPaste your complete encoded JSON Web Token string into the input editor.
2
Automatic Header & Payload SplitThe tool splits the token into Header (algorithm), Payload (claims), and Signature.
3
Inspect Claims & ExpirationView formatted JSON claims with human-readable timestamps for iat, nbf, and exp.
4
Check Validity StatusSee clear visual badges indicating whether the token is currently active or expired.

Key Features

Color-coded token visualizer: Header (Red), Payload (Purple), Signature (Cyan)
Live 2-way editor: Modify JSON payload to automatically sign and re-encode token
Cryptographic HMAC (HS256, HS384, HS512) signature verification with Web Crypto API
Standard claims analysis with live expiration countdown and humanized relative times
Security audit engine detecting alg=none, weak secrets, missing exp, and sensitive data leakage
1-click export to Bearer Authorization header and cURL command

Common Use Cases

Debugging authentication issues in Single Page Applications
Inspecting user roles, permissions, and scopes inside token payloads
Verifying token expiration times

Frequently Asked Questions

No. Decoding reads the public claims inside the token. Verifying checks the cryptographic signature using the secret or public key to ensure it has not been tampered with.