JWT Decoder
Decode a JSON Web Token, read its claims in plain words and verify the signature. Everything runs in your browser. Your token is never sent anywhere.
Read the guide: How to Decode a JWT Safely: Decoding Is Not VerifyingDecoding happens in your browser. The token is never uploaded, logged or stored.
Paste a token above, or load the sample token. The sample is signed with the secret your-256-bit-secret so you can try verification.
How to use the JWT decoder
- Paste a token into the box. You can include the "Bearer " prefix from an Authorization header; it is removed for you. The header and payload appear as formatted JSON right away.
- The Claims card turns exp, iat and nbf into local dates and tells you how long ago or how soon each one is. Expired tokens are marked in red. To convert any other Unix time, use Unix Timestamp Converter.
- To check the signature, enter the shared secret for HS256, HS384 or HS512 tokens. For RS, PS and ES tokens, paste the public key in PEM format (the block that starts with BEGIN PUBLIC KEY). Click Sample token to try it with a known secret.
Frequently asked questions
Is my token sent to a server?
No. Decoding and signature checks run in your browser with JavaScript and the Web Crypto API. The token and the key never leave this tab, which matters when you paste production tokens.
How is this different from jwt.io?
It does the same core job: decode, read claims and verify signatures. It also spells out expiry in plain words and works the same on a phone. Nothing is logged or stored.
Does decoding a JWT mean it is valid?
No. Anyone can read a JWT, because the payload is only base64url encoded, not encrypted. A token is trustworthy only when the signature checks out with the right key and it has not expired.
Which algorithms can it verify?
HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512 (ES512 needs a browser with P-521 support). Tokens with alg set to none are flagged as unsigned.
Why does it say my token has 5 parts?
A token with 5 parts is an encrypted JWE. Its payload cannot be read without the decryption key, so this tool only handles signed tokens with 3 parts.