JWT Decoder
Paste a JWT to instantly decode its header and payload, with optional client-side signature verification.
How to use the JWT Decoder
- Paste a JWT into the JWT box.
- The Header and Payload panels decode automatically a moment after you stop typing, pretty-printed as JSON.
- If the payload has
iat,nbf, orexpclaims, they're shown below the payload as readable dates — with an Expired badge ifexpis in the past. - If the header's
algis"none", a warning badge appears next to Header. - The raw Signature segment is shown as-is for reference.
- Use the Copy buttons to copy the decoded header or payload JSON.
- To check the signature, expand Verify signature. For HS256/384/512 tokens, enter the shared secret (check Secret is base64 encoded if it was issued as a base64 string); for RS256/384/512 tokens, paste the signer's public key as an SPKI PEM (
-----BEGIN PUBLIC KEY-----). The result — valid, invalid, or an error explaining what's wrong with the key — appears immediately below.
How This Tool Works
A JWT is three Base64URL-encoded segments joined by dots — header, payload, and signature. This tool splits on those dots, decodes the header and payload segments (handled as UTF-8 bytes, so non-ASCII claim values like names in other languages don't get mangled), and pretty-prints each as JSON.
Standard date claims — iat, nbf, and exp — are additionally parsed from Unix seconds into readable local dates, with an Expired badge shown if exp is in the past. If the header's alg is none, a warning badge is shown: that means the token claims to be unsigned, a well-known JWT footgun. Nothing is ever sent to a server — decoding happens entirely in your browser, so it's safe to paste real tokens.
An optional Verify signature section lets you check the token's signature against a shared secret (HS256/384/512) or a PEM public key (RS256/384/512), using your browser's built-in Web Crypto API. This check also runs entirely client-side — the secret or key you enter is never sent anywhere, the same guarantee that makes it safe to paste real tokens into the decoder above. RSA verification expects the public key in SPKI PEM format — the kind starting with -----BEGIN PUBLIC KEY-----, e.g. openssl rsa -pubout's output — not a PKCS#1 -----BEGIN RSA PUBLIC KEY----- block or a certificate.