Question 1

Is it safe to decode my JWT here?

Accepted Answer

Yes. Decoding happens entirely in your browser using JavaScript - your token is never transmitted or logged. That said, avoid pasting production tokens containing live secrets into any online tool.

Question 2

Does this verify the JWT signature?

Accepted Answer

No. This tool decodes the header and payload (which are only base64url-encoded, not encrypted) and reads standard claims like exp. Signature verification requires the secret/public key and should be done server-side.

Question 3

What length should my JWT secret be?

Accepted Answer

For HS256, use a secret of at least 32 bytes (256 bits) of randomness. This tool defaults to 32 bytes. For HS512, prefer 64 bytes.

Question 4

What is the difference between base64 and base64url?

Accepted Answer

base64url replaces + and / with - and _ and drops padding, making it safe to use in URLs and JWT contexts. Use base64url if you are unsure.

JWT Decoder & Secret Generator

Powerful Capabilities

100% Client-Side

Instant Decode

Secure Secrets

Frequently Asked Questions