Question 1

What is a JWT?

Accepted Answer

A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64url-encoded parts: header, payload, and signature, separated by dots.

This tool decodes, verifies, and signs JWTs using HMAC algorithms (HS256, HS384, HS512). Everything runs in your browser — no tokens are sent to any server.

Question 2

Is it safe to decode a JWT here?

Accepted Answer

Yes. All decoding, verification, and signing happens entirely in your browser using the Web Crypto API. No token data is sent to any server. However, never share JWTs containing sensitive production data publicly.

Question 3

What is the difference between HS256, HS384, and HS512?

Accepted Answer

All three are HMAC-based symmetric signing algorithms. The number refers to the SHA hash size: 256, 384, or 512 bits. HS256 is the most common. Use HS512 when you need a larger security margin. All require the same secret key to sign and verify.

Question 4

Can this tool verify RS256 tokens?

Accepted Answer

Not currently. This tool supports HMAC algorithms (HS256, HS384, HS512) which use a shared secret. RS256 uses an asymmetric RSA key pair and is not yet supported.

JWT Decoder, Verifier & Signer