Loading tools
Loading tools
Loading tool
Decode + sign + verify HS256/384/512 in browser.
Algorithm + token type
Claims (data)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cA JWT decoder splits a JSON Web Token into header, payload, and signature, decodes the Base64URL segments, parses the JSON, validates expiration claims (exp, iat, nbf), and shows you everything in a structured view. This one also signs new JWTs and verifies HS256/HS384/HS512 signatures -all in your browser. Your token and secret never leave the page.
Most online JWT debuggers run on a server. You paste your token, they parse it, and you have to trust them not to log it. We use Web Crypto subtle.sign for HMAC operations and atob for Base64URL -all local. Same UX, no trust required.
jwt.io is great but you're sending tokens to their server. Our HMAC verify runs locally via Web Crypto. Tokens never leave your laptop.
Most decoders only decode. We let you sign. Useful when testing API auth flows or building OIDC test fixtures.
Unix timestamps in JWTs are a usability nightmare. We render them as human dates with relative-time labels.
Flags weak signing algorithms, missing claims, expired tokens. Catches mistakes before they hit production.
| Feature | Molixa | jwt.io | jwt-decoder.io | DenCode |
|---|---|---|---|---|
| Decode | Yes | Yes | Yes | Yes |
| HS256/384/512 verify | Yes (local) | Yes (server) | Yes | Yes |
| JWT signing | Yes | Yes | No | Yes |
| Time claim humanizer | Yes | Partial | No | No |
| Anti-pattern warnings | Yes | No | No | No |
| Free, no signup | Yes | Yes | Yes | Yes |
| Browser-only verify | Yes | Server-side | Server-side | Yes |
Yes. Unlimited use, no signup, browser-only. jwt.io is the de-facto standard but ships HS256/RS256/ES256 verification only when you trust them with your tokens; we run all the math locally.
JSON Web Token. Three Base64URL-encoded segments joined by dots: header.payload.signature. Used for stateless authentication in APIs and OIDC flows. The signature lets the server trust the token without storing session state.
No. Decoding runs in your browser via atob(). Verification (HS256) runs via Web Crypto subtle.sign. Even your secret never leaves the page. Compare with online debuggers that send your token to their server for parsing.
HS256, HS384, HS512 -the HMAC-based algorithms. Web Crypto handles those natively. For RS256/ES256 (RSA / ECDSA), you need a public key in JWK or PEM format and a few extra steps; we plan to add those.
Decoder shows a status badge: valid, expired, not-yet-valid (nbf in future), or no-expiry. The exp claim is interpreted as Unix seconds and compared to your local clock.
iat = issued at (when the token was created). exp = expiration (when it stops being valid). Standard rotation: server creates token at iat, sets exp = iat + 3600 (1 hour), client refreshes before exp.
Not before. The token is invalid until this timestamp. Used for delayed-activation tokens. Less common than exp/iat. Always check nbf if your token includes it.
Yes. Switch to Sign mode, paste header (or use defaults), paste payload, set secret. We compute HS256/HS384/HS512 signature via Web Crypto and emit the full token. Useful for testing API auth flows locally.
Three usual causes. (1) Wrong secret -the secret used to sign must match the one used to verify. (2) Token tampered with -even one byte change invalidates the signature. (3) Algorithm mismatch -token signed with HS256 won't verify with HS384.
JWT itself is just a format. Security depends on (a) signing algorithm strength -HS256 is fine if the secret is strong; (b) secret strength -32+ random bytes for HS-family; (c) implementation -never accept the 'none' algorithm, always validate the signature server-side, never trust unverified payloads.
Decode, verify, sign. Browser-only. Free unlimited.
Open the JWT decoderThe JWT Decoder page is built, reviewed, and maintained by the Molixa team. We use the tool we ship and update the docs when the behavior changes.