Skip to content
ToolQuil
Developer Tools

JWT Decoder

Decode a JSON Web Token to inspect its header and payload, with optional HMAC/RSA signature verification.

Signature verification is optional — paste a secret (HS256/384/512) or PEM public key (RS256/384/512) only if you want to confirm the token is genuine, not just read its contents.

Tool Interface

Only used in memory to check this one signature — never stored or logged. Other algorithms (ES*, PS*, none) aren't supported for verification yet.

What's this about?
Rating

Related Tools

Featured
Developer Tools

QR Code Generator

Generate a custom QR code with logo and colors.

Use Tool
Developer Tools

JSON Formatter

Format, validate, and beautify JSON.

Use Tool
Developer Tools

Base64 Encoder/Decoder

Encode or decode Base64 strings.

Use Tool
Developer Tools

UUID Generator

Generate UUID/GUID values.

Use Tool

From the Blog

Developer Tools

MD5 vs SHA-256: Which Hash Should You Actually Use?

Both will generate a hash from your input. Only one of them should be anywhere near anything security-related in 2026.

Jul 15, 2026 Read More
Developer Tools

Why Your JSON Looks Like a Mess (and How to Fix It in One Paste)

API responses and minified config files often come back as one unreadable line. Here's what's actually wrong with it and how formatting fixes it.

Jul 13, 2026 Read More
Developer Tools

What's Inside a JWT? A Plain-English Breakdown

JSON Web Tokens look like gibberish, but they're just Base64-encoded JSON with a signature stapled on. Here's what each part means and how to verify one.

Jul 11, 2026 Read More

Frequently Asked Questions

No — leave it blank to just decode the header and payload, exactly like before. It only checks the signature if you paste a key.

For HS256/HS384/HS512, paste the shared secret used to sign the token. For RS256/RS384/RS512, paste the PEM-formatted public key, not the private key.

No — it's used in memory for a single verification check on this request and is never saved or logged.