Log In Sign Up Free

🎫 JWT Decoder & Verifier

Paste a JSON Web Token — see decoded header, payload, and signature with claim breakdown + expiry check. Verify HS256/384/512 with a secret, or RS/ES with a public key. 100% client-side.

JWT (paste here) 3 dot-separated segments
Paste a JWT to decode.
Decoded
Header · Algorithm & Token Type
—
Payload · Data
—
Signature
—
Verify signature alg: —
Idle
Sample tokens
Copied

About JWT Decoder

JWT Decoder is a browser-based tool for inspecting and verifying JSON Web Tokens — the URL-safe token format used by OAuth 2.0, OpenID Connect, Auth0, Firebase, AWS Cognito, and countless bespoke authentication systems. Paste the encoded token and instantly see its header, payload, and signature. Standard claims like iat, exp, nbf, iss, sub, aud, and jti are surfaced with human-readable timestamps and expiry checks.

Signature verification runs entirely client-side via the browser's Web Crypto API — HS256/384/512 with a shared secret, or RS256/384/512 and ES256/384 with a PEM public key. Nothing is sent to a server, so it's safe to test tokens containing sensitive claims.

100% client-side: decoding, claim inspection, and signature verification all run in your browser. Never paste production tokens into online tools you don't trust — this one runs locally with zero telemetry.

How to use

1

Paste your JWT

Left panel accepts the compact three-segment token (header.payload.signature). Segments are color-coded live.

2

Read the decoded output

Right panel shows header + payload as pretty-printed JSON, plus a claims table with timestamps converted to your local time.

3

Verify the signature

Paste your secret (HS*) or public key PEM (RS*/ES*) into the verify box and click Verify. Get a pass/fail with clear reason.

4

Copy

Header JSON, payload JSON, or the whole decoded blob — one click each.

Key Features

Live syntax-highlighted input

Header segment glows red, payload purple, signature blue — makes it easy to see the token structure at a glance and spot missing dots.

Standard claim breakdown

iat (issued at), exp (expiration), nbf (not before) show as concrete local timestamps + relative time. iss (issuer), sub (subject), aud (audience), jti (JWT ID) are labeled clearly.

Expiry check

Instantly see if the token is expired, will expire soon, or is still valid. Expired tokens show a red banner with "expired X minutes ago"; valid tokens show green with time-remaining.

Signature verification (5 algorithms)

HS256 / HS384 / HS512 — paste the shared secret. RS256 / RS384 / RS512 — paste the PEM public key (SPKI). ES256 / ES384 — same, ECDSA public key. Verification uses the browser's Web Crypto — no third-party libraries, no server call.

"None" alg warning

If you paste a token with alg: none, the tool flashes a red warning — this is a well-known JWT security foot-gun where implementations that don't check accept unsigned tokens as valid.

Sample tokens

Four presets: canonical HS256 example, expired token, no-alg token (for testing your validator's resilience), and a Auth0-style RS256 payload.

Copy anything

Header JSON, payload JSON, or the full {header, payload} object. Each with its own Copy button.

Common Use Cases

  • Debugging why an API returns 401 — is the token expired? Missing a claim?
  • Inspecting an Auth0 / Firebase / Cognito / Okta ID token
  • Verifying OAuth 2.0 access tokens returned by your identity provider
  • Learning what claims your auth system is emitting (compare dev vs prod)
  • Testing your JWT library correctly rejects alg: none
  • Sanity-checking a token from a bug report before touching the code
  • Confirming a rotated signing key still verifies existing tokens
  • Copying the decoded payload into a bug ticket or documentation

Security & Privacy

  • 100% client-side: decoding + verification via Web Crypto in your browser. No token, secret, or private data ever leaves your device.
  • Works offline: disconnect after page load and it still works.
  • Warning about secrets: HMAC "secrets" pasted here are technically visible to any browser extension you have installed. If you have unknown extensions enabled, use an incognito window or a browser without extensions for real production secrets.
  • Private keys: the verify field only accepts public keys — never paste a private key or signing key here. Verification is signature-checking only, not signing.
  • alg: none: some naive implementations accept tokens with alg: none as valid. If your validator does, that's a critical bug — this tool lets you test.
  • JWT is not encryption: the payload is base64-encoded, not encrypted. Anyone with the token can read it. Don't put secrets in JWT payloads.

Frequently Asked Questions

HS256 / HS384 / HS512 (HMAC with SHA), RS256 / RS384 / RS512 (RSA-PKCS1 with SHA), and ES256 / ES384 (ECDSA with SHA on P-256/P-384). All done via the browser's native Web Crypto API.
PEM-encoded public key in SPKI format — the multi-line block that starts with -----BEGIN PUBLIC KEY-----. Auth0 exposes this in the JWKS endpoint; convert your JWK to PEM if that's what you have.
No. Everything happens in your browser via Web Crypto. Verify with DevTools → Network — no requests fire when you paste or click Verify.
Only if you trust the browser you're in (no shady extensions). Even though this tool runs client-side, a malicious extension can read your DOM. For super-sensitive tokens, use an incognito window with extensions disabled, or clone the source and run it offline.
Most common causes: wrong secret / public key, wrong algorithm (mismatch between what the token says and what you're using to verify), or the token has been tampered with. Double-check the alg in the header and use the exact key that signed the token.
Historically, some JWT libraries accepted tokens with alg: none as "verified" — meaning an attacker could forge tokens by simply setting the alg to none and dropping the signature. All modern libraries reject this by default, but if you're on an old library or wrote your own validator, this is worth testing. This tool loads a sample "none" token for you to try against your validator.
Yes — no signup, no ads, no limits.