EN

JWT decoder

Paste a JSON Web Token to read its header and claims, see when it expires and verify the signature with a secret or public key. The token never leaves your browser.

Free and private. Everything runs in your browser, nothing is uploaded.

How it works

  1. Paste the tokenPaste the JWT, with or without the Bearer prefix.
  2. Read the claimsSee the header, payload and dates in plain language.
  3. VerifyOptional: enter the secret or public key to check the signature.

Safe for real tokens

Online JWT debuggers are convenient, but pasting a live access token into someone else's website is risky: anyone who logs it can use it until it expires. This decoder runs entirely in your browser. Nothing is sent, logged or stored, so you can inspect production tokens while debugging authentication.

Dates in exp, iat, nbf and auth_time are shown in your local time with a relative hint, and the status tells you at once whether the token has expired.

Signature verification

For HS256, HS384 and HS512 enter the shared secret. For RS, PS and ES algorithms paste the public key in PEM format, beginning with BEGIN PUBLIC KEY. Verification uses the Web Crypto API of your browser. Tokens with alg none are flagged, since they carry no signature at all.

Frequently asked questions

Is my token sent anywhere?

No. Decoding and verification happen in your browser.

Can I decode a token without the secret?

Yes. The header and payload are only encoded, not encrypted. The secret is needed only to verify the signature.

Which algorithms can be verified?

HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512.

What about encrypted tokens (JWE)?

Encrypted tokens have five parts and cannot be read without the private key. The tool tells you when you paste one.