JWT Decoder & Verifier — Inspect JSON Web Tokens
Decode a JWT's header and payload with readable claims, and optionally verify its signature locally. Free, no sign-up, and your files never leave your device.
Free, with no sign-up and no watermark. The file is processed in your browser and never uploaded.
Paste a JSON Web Token to see its header and payload as formatted JSON, with standard claims explained and timestamps (exp, iat, nbf) shown as dates — including whether the token has expired. You can also verify the signature locally: HS256/384/512 with a secret, or RS, PS and ES algorithms with a public key in PEM or JWK form.
Step by step
- Paste the token: A leading
Beareris removed automatically. Try Load sample to see how it works. - Read the claims: Header and payload appear side by side, with a claims table below.
- Verify (optional): Enter the secret or paste the public key, then click Verify signature.
- Check the result: You'll see Signature verified ✓ or Invalid signature ✗.
Handy for
Debugging auth
See what claims and scopes a token actually carries.
Expiry problems
Check whether a token has expired or is not yet valid.
Key rotation
Confirm a token verifies with a new public key.
Security review
Spot dangerous alg: none tokens.
Good to know
Decoding alone proves nothing — anyone can create a token with any payload. Only signature verification proves who issued it.
Never paste production secrets into websites that send data to a server; this tool verifies with your browser's WebCrypto and sends nothing.
Questions
Can it decrypt encrypted tokens (JWE)?
No. Encrypted JWTs have five parts and need the private key to decrypt; this tool handles signed JWTs (three parts).
Which algorithms can be verified?
HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512.
Is my data sent anywhere?
No. Everything is processed by JavaScript in your browser tab — nothing you paste or open is uploaded, logged or stored on a server. You can even use the tool offline once the page has loaded.
Further reading
- Format and Convert JSON, Decode JWTs and Base64 Safely — Validate JSON with exact error positions, convert it to CSV, YAML or XML, and decode JWTs and Base64 in your browser without sending tokens to a server.
More Developer Tools tools
- Hash Generator — Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes or HMACs of text and files.
- UUID / GUID Generator — Generate random UUID v4 or time-ordered v7 identifiers in bulk, in the format you need.
- Strong Password Generator — Create strong random passwords or passphrases with a strength meter, using your device's secure randomness.
- Regex Tester — Test regular expressions with live match highlighting, capture groups and a replace preview.
- Unix Timestamp Converter — Convert Unix timestamps in seconds or milliseconds to readable dates in any time zone, and back.
- Binary, Hex & Decimal Converter — Convert numbers between binary, octal, decimal, hexadecimal and any base from 2 to 36, of any size.