JWT Decoder
JWT Decoder shows a JSON Web Token's header, payload and expiry in your browser and verifies HS, RS, PS, ES or EdDSA signatures with WebCrypto.
Your token never leaves this tab. Decoding and signature checks run in your browser; nothing is sent, logged or stored.
At a glance
- Accepts
- A signed JWT (three parts), plus optionally the HMAC secret or a public key as PEM or JWK
- Outputs
- Formatted header and payload JSON, exp/iat/nbf as dates, and a valid or invalid signature result
- Where it runs
- Entirely in your browser, on your device
- What leaves your device
- Nothing - the token, secret and key stay in this tab
- Limits
- Encrypted tokens (JWE) can't be read without the recipient's key; keys aren't fetched from JWKS URLs, so paste the key
- Account
- Not required - there is no sign-up
- Price
- Free, with no watermark and no usage cap
- Made by
- Visrut
- Last updated
- 11 October 2026
A JSON Web Token (JWT, RFC 7519) is three base64url-encoded parts joined by dots: a header naming the signing algorithm, a payload of claims (who the token is for, when it expires), and a signature. This decoder shows the header and payload as formatted JSON, turns exp, iat and nbf into dates, and checks the signature if you give it the secret or public key. Everything runs in your browser, so tokens, secrets and keys stay on your device.
How to use it
- Paste the token. A leading
BearerorAuthorization:and stray line breaks are removed for you. - Read the header, payload and time claims. A red badge means the token has expired.
- To check the signature, paste the shared secret (HS256, HS384, HS512) or the issuer's public key as PEM or JWK (RS, PS, ES and EdDSA). The result shows as valid, invalid or not checked.
What it can't do
It can't read an encrypted token (JWE, five parts) without the recipient's private key, and it doesn't fetch keys from an issuer's JWKS URL, since that would mean a network request. Copy the key from the JWKS yourself and paste it in.
Frequently asked questions
Is my token sent anywhere?
No. The token is split and decoded in your browser, and signature checks use the browser's built-in WebCrypto. Nothing you paste here, token, secret or key, is sent to a server, logged or stored.
Is it safe to paste a real token?
Nothing leaves this tab, but a live token is still a password while it's valid: anyone who sees it can use it. Prefer an expired token or one from a test environment, and never paste one into a site that sends it to a server.
Does decoding a JWT prove it's genuine?
No. Anyone can decode a JWT, because the header and payload are only base64url-encoded, not encrypted. Only a valid signature proves the token came from whoever holds the key. Paste the secret (HS256/384/512) or the public key (RS, PS, ES, EdDSA) to check it.
Which signature algorithms can it verify?
HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA. HMAC algorithms take the shared secret, as plain text or Base64. The others take a public key as PEM (-----BEGIN PUBLIC KEY----- or -----BEGIN RSA PUBLIC KEY-----) or as a JWK, including a whole JWKS, where the key is picked by the token's kid.
What does alg "none" mean?
The token claims to have no signature at all, so anyone could have written it. A server should never accept alg "none" unless it was configured to on purpose; accepting it by mistake is a well-known JWT vulnerability.
What are exp, iat and nbf?
Registered claims from RFC 7519, each a time in seconds since 1 January 1970 UTC. exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. The decoder shows each as a date in your time zone and as a relative time.
Why does it say the token is encrypted?
A token with five dot-separated parts is a JWE (RFC 7516): its payload is encrypted, not just encoded. Only the recipient's private key can open it, so a decoder can show the header at most.