JWT Decoder & Verifier
Format & ValidateDecode a JWT's header and payload, and verify its signature — right in your browser.
What's inside a JWT?
A JSON Web Token is three Base64URL-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims — things like the user's id, roles, and an expiry time — and the signature proves neither part was altered after signing.
Because the header and payload are just Base64URL-encoded JSON, anyone can decode and read them without a key; only the signature step actually requires cryptographic material. That's an intentional part of the JWT design, and it's worth remembering not to put secrets you don't want readable inside a token's payload.
Verifying the signature
Decoding tells you what a token claims; verifying tells you whether to trust it. This tool checks the signature locally using the Web Crypto API built into your browser — for HS256/384/512 tokens, supply the shared secret; for RS256/384/512 or ES256/384/512 tokens, supply the signer's PEM-formatted public key.
Nothing you enter here is transmitted anywhere: the token, the secret, and the key are only ever processed in memory in your browser tab, which makes it safe to check tokens signed with production secrets during debugging.
Reading expiry and other standard claims
Most JWTs carry a handful of registered claims worth checking at a glance: exp (expiry), iat (issued at), and nbf (not valid before) are all Unix timestamps. This tool converts them to readable dates and flags whether the token is currently expired or not yet valid, so you don't have to do the timestamp math by hand while debugging an auth failure.
Everything in the JWT Decoder & Verifier
Decode a JWT's header and payload instantly, and verify its signature with your own secret or public key (HS256/384/512, RS256/384/512, ES256/384/512). Free, private, runs entirely in your browser.
Instant decode
See the header and payload as formatted JSON as you paste.
Signature verification
Verify HS256/384/512 (secret) or RS/ES256/384/512 (public key).
Claim awareness
Expiry, issued-at, and not-before claims are checked and flagged.
Key never leaves your browser
Verification runs locally via the Web Crypto API — your secret or key is never sent anywhere.
Frequently asked questions
A JSON Web Token (JWT) is a compact, signed token used for authentication and authorization. It has three Base64URL-encoded, dot-separated parts: a header describing the signing algorithm, a payload of claims (like user id or expiry), and a signature that proves the token wasn't tampered with.
No. Signature verification runs entirely in your browser using the native Web Crypto API. Your secret or public key, and the token itself, are never uploaded or logged — nothing leaves your device.
HS256, HS384, and HS512 (with a shared secret), plus RS256, RS384, RS512, ES256, ES384, and ES512 (with a PEM-formatted public key). Tokens signed with alg: none are decoded but flagged as unsigned, since there's no signature to check.
Yes. The decoded payload highlights the exp (expiry), iat (issued at), and nbf (not before) claims and converts them to readable dates, and flags the token as expired or not yet valid based on your device's clock.
No — the header and payload are just Base64URL-encoded JSON, so they decode and display instantly with no key required. A secret or public key is only needed for the separate signature-verification step, which confirms the token is authentic rather than merely well-formed.
No. Every operation runs entirely in your browser using client-side JavaScript. Your input is never uploaded, logged, or stored on any server — it never leaves your device.
Yes, completely free with no sign-up required. There are no usage limits, no watermarks, and no premium gate on any feature.
Related tools
Base64 Encoder/Decoder
Encode text to Base64 or decode Base64 back to text — instantly, in your browser.
JSON Validator
Validate, verify, and check JSON — every syntax error pinpointed by line and column.
JSON Formatter
Beautify, minify, and repair messy JSON — even Python dicts and JS objects — into clean, valid output.
JSON Schema Validator
Check that your JSON matches a JSON Schema — with every error pinpointed by path.