Instant, color-coded decoding
The header, payload and signature are highlighted in the token and decoded into formatted, syntax-colored JSON as you paste.
header.payload.signature
JWT Decoder Decode, verify and create JSON Web Tokens
Paste a JSON Web Token to decode its header and payload instantly, see every claim explained with readable dates, check expiry and verify the signature with a secret or public key. Everything runs locally in your browser.
- Instant decode
- Verify HS, RS, PS, ES, EdDSA
- Expiry check
- Never leaves your device
JWT decoder and encoder
Verify signature
Enter the secret or public key used to sign this token.
Signature not checked yet.
Header
Paste a token to see its header.Payload
Paste a token to see its payload.Claims explained
Times shown in your time zoneClaims appear here with plain-English meanings.
Updates as you type
Tokens are signed in your browser with the Web Crypto API. Use a secret of at least 32 random characters for HS256 in real systems.
Why it's better
Why this JWT decoder is better
Most JWT tools only show raw JSON. This one explains every claim, checks expiry for you, verifies all common signature algorithms and never sends your token anywhere.
Verify any common algorithm
Check HS256, HS384 and HS512 with a secret, or RS, PS, ES and EdDSA tokens with a PEM public key, JWK or a whole JWKS.
Claims explained with dates
exp, iat, nbf and auth_time become readable local times with "expires in" or "expired ago", and common claims get plain-English labels.
Security warnings
Status badges flag expired or not-yet-valid tokens, unsigned alg none tokens and encrypted JWE tokens at a glance.
Create signed test tokens
Build tokens with your own header and payload, set iat and exp in one click and sign them with HS256, HS384 or HS512.
100% local and private
Decoding, verification and signing all use your browser's built-in crypto. Tokens and keys are never uploaded or saved.
How it compares with typical JWT tools
| Feature | This JWT decoder | Typical JWT tools |
|---|---|---|
| Runs entirely in the browser | Yes | Not always clear |
| Claims explained in plain English | Yes | Rarely |
| Readable dates and expiry status | Yes, with relative time | Sometimes |
| Verify with a JWKS | Yes, matched by kid | Rarely |
| EdDSA and RSA-PSS support | Yes | Sometimes |
| alg none and JWE warnings | Yes | Rarely |
| Bearer prefix removed automatically | Yes | Rarely |
How to use
How to decode and verify a JWT
From an Authorization header to verified claims in a few seconds.
Working with other encodings? Try the Base64 encoder and decoder, format any JSON with the JSON formatter or convert epoch times with the Unix timestamp converter.
Paste your token
Paste the JWT, even with a Bearer prefix or line breaks. It's decoded instantly and each part is colored.
Read the header and payload
See the algorithm and key ID in the header, and every claim in the payload as formatted JSON.
Check the claims
The claims table explains each field and shows exp, iat and nbf as local times with an expiry badge.
Verify the signature
Enter the shared secret for HS tokens, or paste the public key or JWKS for RS, PS, ES and EdDSA tokens.
Create test tokens
Switch to Create to edit a header and payload and sign a new token for testing your API.
The basics
What is a JSON Web Token?
A JSON Web Token (JWT) is a compact way to pass claims between systems, defined in RFC 7519. It has three Base64URL-encoded parts separated by dots: a header describing the algorithm, a payload holding the claims, and a signature that proves the token hasn't been changed.
A signed JWT is encoded, not encrypted. Anyone who has the token can read its payload, which is exactly what this decoder does. Only the signature check tells you whether it can be trusted.
xxxxx.yyyyy.zzzzz
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token |
sub | Subject | Who the token is about, usually a user ID |
aud | Audience | Which service the token is meant for |
exp | Expiration time | Unix time after which it must be rejected |
nbf | Not before | Unix time before which it must be rejected |
iat | Issued at | Unix time when the token was created |
jti | JWT ID | Unique ID, useful to prevent replay |
Algorithms
JWT signing algorithms compared
The alg value in the header decides how the signature is made and which key you need to verify it.
| alg | Method | Verify with | Typical use |
|---|---|---|---|
HS256 / HS384 / HS512 | HMAC with SHA-2 | The same shared secret | Single backend that both issues and checks tokens |
RS256 / RS384 / RS512 | RSA PKCS#1 v1.5 | RSA public key | OAuth and OpenID Connect providers |
PS256 / PS384 / PS512 | RSA-PSS | RSA public key | Modern RSA deployments and open banking |
ES256 / ES384 / ES512 | ECDSA (P-256, P-384, P-521) | EC public key | Mobile and IoT, where smaller signatures help |
EdDSA | Ed25519 | Ed25519 public key | Fast, modern signatures |
none | No signature | Nothing | Never accept in production |
Security
JWT security best practices
Decoding a token is harmless, but trusting one is not. These checks belong in every API that accepts JWTs.
Need a strong signing secret? Create one with the password generator or check hashes with the hash generator.
- Always verify the signature on the server before trusting any claim.
- Allow only the algorithms you expect and reject
alg: none. - Check
exp,nbf,issandaudon every request. - Never put passwords or secrets in the payload; it can be read by anyone.
- Keep access tokens short-lived and use refresh tokens for long sessions.
- Use secrets of at least 256 bits for HS256, or switch to asymmetric keys.
FAQ
JWT decoder FAQ
What is a JWT decoder?
It splits a JSON Web Token into its header, payload and signature and turns the Base64URL text back into readable JSON, so you can see the claims inside.
Is it safe to paste my JWT here?
Decoding and verification run entirely in your browser, and tokens and keys are never sent anywhere or stored. Still, treat production tokens like passwords and avoid sharing them.
Can anyone read the data in a JWT?
Yes. A normal signed JWT is only encoded, not encrypted, so anyone with the token can read the payload. Never put passwords or other secrets in it.
How do I verify a JWT signature?
Paste the token, then enter the shared secret for HS256, HS384 or HS512, or the public key as PEM, JWK or JWKS for RS, PS, ES and EdDSA tokens. The result shows whether the signature is valid.
Why does my token show as expired?
The exp claim is a Unix timestamp. If it's earlier than your device's current time, the token has expired. If the result looks wrong, check your device clock.
What's the difference between HS256 and RS256?
HS256 uses one shared secret to both sign and verify. RS256 signs with a private RSA key and verifies with the matching public key, so services that only verify never need the secret.
Can I create a JWT with this tool?
Yes. Open Create, edit the header and payload, pick HS256, HS384 or HS512, enter a secret and copy the signed token.
Why can't I read an encrypted token?
Tokens with five parts are JWE, which means the payload is encrypted. It can only be read with the decryption key, so only the header is shown.
What does an invalid signature mean?
The token was signed with a different secret or key, or it was changed after signing. Check that you're using the right key and that the secret's Base64 setting is correct.
Decode your token now
Paste a JWT to see its claims, check expiry and verify the signature. Free, instant and private.
Open the JWT decoderMore developer tools