JWT Decoder

JWT Decoder

Decode & Verify JSON Web Tokens — Instantly In Your Browser

Paste a JWT to see its header, payload, and claims explained in plain English. Check expiration status at a glance, and optionally verify the signature with HMAC, RSA, or ECDSA. Everything runs in your browser — your token and keys never leave your device.

🔒 Runs entirely in your browser — your token and keys are never transmitted to any server

Quick Start:

JWT Token

Header

Payload

Signature (Not Verified)

Token Status

—

Claims

Claim	Meaning	Value

Verify Signature (Optional)

Shared Secret

All decoding and signature verification runs locally in your browser. Your token, secret, and keys are never transmitted to a server. Treat tokens and keys like passwords — avoid pasting real production secrets into any online tool.

How to Use the JWT Decoder

Paste Your JWT

Paste your JSON Web Token into the Token field, or click Load Example Token to see the tool in action right away. The token decodes automatically as you type or paste — nothing is sent anywhere.

Review the Decoded Header and Payload

The Header and Payload panels show the formatted contents of your token. The Claims table below explains each standard field — like who issued the token and when it expires — in plain English next to its actual value.

Check the Token Status

The status panel tells you instantly whether the token is Valid, Expired, or has No Expiration Set, along with a plain-English time remaining or elapsed — perfect for debugging authentication issues.

Verify the Signature (Optional)

Choose the algorithm family — HMAC, RSA, or ECDSA — then enter your shared secret or public key (PEM or JWK format) and click Verify Signature. The result tells you whether the signature matches, computed entirely on your device.

Frequently Asked Questions

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three parts separated by dots: a header, a payload, and a signature. JWTs are commonly used for authentication and information exchange in web applications.

Is decoding a JWT the same as verifying it?

No. Decoding simply reveals the contents of the header and payload, which are readable by anyone since they are only encoded, not encrypted. Verifying confirms the signature was created using a specific secret or key, which proves the token has not been tampered with. This tool supports both: decoding happens automatically, and signature verification is available if you choose to provide a secret or key.

Is my token or key sent to a server?

No. This tool runs entirely in your browser. Your token, secret, and any keys you enter are never transmitted to any server or stored anywhere. Once you close the tab, the data is gone.

What signing algorithms are supported for verification?

This tool supports signature verification for HMAC algorithms (HS256, HS384, HS512) using a shared secret, and for RSA and ECDSA algorithms (RS256, RS384, RS512, ES256, ES384, ES512) using a public key in either PEM or JWK format.

Why does the tool say my token is expired?

JWTs commonly include an expiration claim that marks the point in time after which the token should no longer be accepted. This tool compares that claim to your current device time and flags the token as expired if that time has passed. This is a common and expected part of normal token lifecycles.

Should I paste a real production token or key into this tool?

Treat tokens and keys the same way you would treat a password. While this tool does not transmit or store anything you enter, it is good practice to use sample or development tokens whenever possible, and to avoid pasting live production secrets into any online tool, including this one.