QSTools
JWT Decoder
Decode header and payload. Nothing is sent to a server.
Paste a token to inspect header and payload.
Header
Payload
Signature
Verify signature (optional)
Runs only in this browser — we never receive your secret. Still skip production secrets on shared or untrusted devices (browser extensions can read this page).
About this tool
A JSON Web Token (JWT) packs claims into three Base64URL segments: header, payload, and signature. This tool decodes header and payload in your browser, and can optionally verify HMAC signatures (HS256 / HS384 / HS512) with a secret you paste locally — nothing is uploaded to our servers.
FAQ
- Is my token or secret uploaded?
- No. Decode and verify run in the browser. We still recommend avoiding production secrets on shared or untrusted devices, because browser extensions can read page content.
- Does QSTools verify the signature?
- Optionally, yes — for HS256 / HS384 / HS512 when you provide the HMAC secret. RS/ES public-key verify is not in this version yet.
- Why is my token invalid?
- Usually a truncated paste, bad Base64URL, non-JSON claims after decode, or a wrong secret when verifying.