Free JWT Decoder
JWT Decoder reads a JSON Web Token's header, payload and signature, lists its claims and says in plain words whether it has expired. It verifies HS, RS, PS, ES and EdDSA signatures with a secret, PEM key, X.509 certificate, JWK or JWKS, and signs test tokens. Tokens and keys never leave your browser.
- Algorithms:
- HS, RS, PS, ES and EdDSA
- Keys:
- Secret, PEM, X.509, JWK, JWKS
- Encode:
- Signs test tokens
- Price:
- Free
- Runs:
- Locally, in your browser
- Uploads:
- None: files never leave your device
- Account:
- Not needed
Quick answers
Is it safe to paste a real token here?
Tokens and keys are processed only in your browser and never sent anywhere. Even so, treat live tokens like passwords and prefer test tokens when you can.
Processed on your device: your files are never uploaded. How it works
Network activity in this tab
What this page has requested since you opened the site in this tab. An upload is any request that sends data: POST, PUT, PATCH or a request with a body.
No uploads: nothing has been sent from this page.
No network requests yet.
To see every request, open your browser's developer tools (Network tab).
How to use the JWT Decoder
- Paste a token: header, payload and signature are color-coded and decoded instantly.
- Check the claims table for issuer, subject and the expiry status in plain words.
- Enter the secret or public key to verify the signature.
- Use the Encode tab to sign your own test tokens.
Credits & open source
Our own code plus open-source libraries. Thank you to the people who make these projects.
- joseJWT signing, verification and decoding. © Filip Skokan · MIT
Web platform APIs used: Web Crypto, TextEncoder, Intl, Clipboard API.
Full license texts: third-party notices · all credits
Frequently asked questions
Does decoding prove a token is valid?
No. Anyone can read a JWT's contents. Only a successful signature verification with the right key shows that the token is genuine and unmodified.
Which key do I need to verify?
For HS256/384/512 the shared secret. For RS, PS, ES and EdDSA the public key, as a PEM, an X.509 certificate or a JWK/JWKS.